Denial Of Service (DoS)

gdm3 is vulnerable to denial of service DoS. The vulnerability is in gdm3 LPE due to unresponsive accounts-daemon.this could allow a local user to create a new privileged account...

WooCommerce Blocks < 3.7.1 - Guest Account Creation

Versions of WooCommerce prior to 4.6.2 contain a vulnerability that allows guest users to create accounts during checkout even when the "Allow customers to create an account during checkout" setting is disabled. This vulnerability is being exploited by a bot to place spam orders and create user...

Veeam ONE creates or changes local accounts of the "Veeam_*" format at the Veeam ONE server machine

Challenge Veeam ONE creates or changes local accounts of the "Veeam" format on the Veeam ONE server machine. Cause This behavior is a part of the Veeam ONE design. Veeam ONE creates these temporary Windows accounts for login and authentication operations between Veeam ONE components and VMware...

Deception Technology: No Longer Only A Fortune 2000 Solution

A cyber-attacker successfully breaks into your environment and begins sneaking around to find something valuable - intellectual property, bank account credentials, company plans, whatever. The attacker makes his way to a certain host on a network node to browse the directories, and suddenly, his...

FUEL CMS Information Disclosure Vulnerability

FUEL CMS is a content management system CMS based on the Codelgniter framework. An information disclosure vulnerability exists in FUEL CMS version 11.4.12 and earlier, which allows an anonymous user to take full ownership of any account, including the administrator account...

Cisco Integrated Management Controller Username Enumeration Vulnerability

A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication...

Removing the Groups from the Accounts>Groups page doesn't remove the references from the Project Permissions page

h3. Issue Summary Removing the Groups from the AccountsGroups page doesn't remove the references from the Project Permissions page and the Global permissions page h3. Steps to Reproduce Create a New group named "newtestgroup" Add a user to the Group Add the Group Access for "newtestgroup" under t...

Removing the Groups from the Accounts>Groups page doesn't remove the references from the Project Permissions page

h3. Issue Summary Removing the Groups from the AccountsGroups page doesn't remove the references from the Project Permissions page and the Global permissions page h3. Steps to Reproduce Create a New group named "newtestgroup" Add a user to the Group Add the Group Access for "newtestgroup" under t...

Apple macOS Catalina Login Window Information Disclosure Vulnerability

Apple macOS Catalina is a specialized operating system developed by Apple Inc. for Mac computers. An information disclosure vulnerability exists in the login window of macOS Catalina versions prior to 10.15.6. An attacker can exploit this vulnerability to log in to other user accounts...

Monitorr 1.7.6m - Authorization Bypass

!/usr/bin/python -- coding: UTF-8 -- Exploit Title: Monitorr 1.7.6m - Authorization Bypass Date: September 12, 2020 Exploit Author: Lyhin's Lab Detailed Bug Description:...

Monitorr 1.7.6m Authorization Bypass

!/usr/bin/python -- coding: UTF-8 -- Exploit Title: Monitorr 1.7.6m - Authorization Bypass Date: September 12, 2020 Exploit Author: Lyhin's Lab Detailed Bug Description:...

University Email Hijacking Attacks Push Phishing, Malware

Cybercriminals are hijacking legitimate email accounts from more than a dozen universities – including Purdue University, University of Oxford in the U.K. and Stanford University – and using the accounts to bypass detection and trick victims into handing over their email credentials or installing...

bank-accounts-direct.co.uk Cross Site Scripting vulnerability OBB-1460660

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

SAP Solution Manager and Focused Run Improper Authentication Vulnerability

SAP Solution Manager and SAP Focused Run are both products of SAP, a German company. SAP Solution Manager is a system management platform that integrates system monitoring, SAP support desktop, self-service, ASAP implementation and other functions. The platform can help customers establish SAP...

CVE-2020-27179

konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens...

CVE-2020-27183

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...

CVE-2020-27179

konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens...

Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover

Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on SSO to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to...

Shopify: Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com

Hi, Description I have found that it is possible to add external login service even if the email address is not verified. This allows someone to create an account with an email he does not own and create some kind of backdoor accounts that would allow him to get access to shops and more. In the...

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with...