1043 matches found
REST API for Add user to group returns error 400 instead of 404 when the user does not exist
h3. Issue Summary REST API for Add user to group returns error 400 instead of 404 when the user does not exist. According to the documentation of JIRA 8.5.3|https://docs.atlassian.com/software/jira/docs/api/REST/8.5.3/api/2/group-addUserToGroup when the user or group does not exist, an error 404...
CVE-2020-11663
CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks...
CVE-2020-11663
CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks...
CVE-2020-11663
The CVE-2020-11663 entry affects CA API Developer Portal versions up to 4.3.1. The root cause is insecure handling of 404 responses, which can enable open redirect attacks. Exploitation details or affected environments are not provided in the connected documents; no patch/version remediations are...
CVE-2020-11663: URL Redirection to Untrusted Site
CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks...
CVE-2020-11576: Observable Discrepancy
Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...
DotNetNuke Cookie Deserialization Remote Code Execution Exploit
This Metasploit module exploits a deserialization vulnerability in DotNetNuke DNN versions 5.0.0 through 9.3.0-RC. Vulnerable versions store profile information for users in the DNNPersonalization cookie as XML. The expected structure includes a "type" attribute to instruct the server which type ...
jetty: error path information disclosure
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...
jetty: error path information disclosure
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...
Opening 404 page (page not found) without user session will open 404 page instead of opening login page.
h3. Issue Summary Opening a random page on Jira with a user that is not authenticated will display "Page not found" 404 page instead of the login page. h3. Steps to Reproduce Make sure you are not logged in. Try to open BaseURL/ABC h3. Expected Results As you do not have session information you...
Opening 404 page (page not found) without user session will open 404 page instead of opening login page.
h3. Issue Summary Opening a random page on Confluence with a user that is not authenticated will display "Page not found" 404 page instead of the login page. h3. Steps to Reproduce Make sure you are not logged in. Try to open BaseURL/ABC h3. Expected Results As you do not have session information...
CVE-2020-10105
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html...
CVE-2020-10105: Files or Directories Accessible to External Parties
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html...
Mail.ru: Reflected XSS at city-mobil.ru
Reflected XSS via URI vector in https://city-mobil.ru/ 404 response...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
Cross site scripting
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 is affected by a reflected XSS in the 404-not-found component. The CVE details confirm the issue (XSS) and that a fixed version is 3.7.1. The vulnerability is non-authenticated per CVSS2/3.1 vectors, with impact to integrity. Publicly documented remediation is upgrading...