GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

PT-2026-96251

Name of the Vulnerable Software and Affected Versions Sync-in Server versions prior to 2.4.1 Description An observable timing discrepancy exists in the login process. When an authentication attempt is made for a nonexistent account, the system returns a response immediately without performing the...

Stack overflow

Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method...

CVE-2011-3142: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method...

PT-2011-4271

Name of the Vulnerable Software and Affected Versions WellinTech KingView versions 6.52 through 6.53 Description The issue is related to a stack-based buffer overflow in an ActiveX control in KVWebSvr.dll. This allows remote attackers to execute arbitrary code via a long second argument to the...

PT-2011-1395

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500 Description The issue allows remote attackers to reset user passwords by providing a user id to "accounts/ValidateUser" and then a new password to "accounts/ResetResult", which c...

CVE-2010-3273: Improper Input Validation

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

IBM DB2 db2dasrrm validateUser Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the db2dasrrm process responsible for handling queries to the com.ibm.db2.das.core.DasSysCmd...

CVE-2010-3731

Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server DAS component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long...

PT-2010-5025

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP10 IBM DB2 versions 9.5 before FP6a IBM DB2 versions 9.7 before FP3 Description The issue is related to a stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd functi...

CVE-2010-3731: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server DAS component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long...