845 matches found
CVE-2019-4723
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page. IBM X-Force ID: 172129...
CVE-2019-4723
CVE-2019-4723 affects IBM Cognos Analytics 11.0 and 11.1, where a remote attacker could obtain credentials from a user's browser due to incorrect autocomplete settings in the New Data Server Connection page. Root cause/impact are described in IBM/IBM X-Force references; cloud versions are address...
IBM Cognos Analytics 授权问题漏洞
IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An information disclosure...
Bizarro Banking Trojan Sports Sophisticated Backdoor
A never-before-documented Brazilian banking trojan, dubbed Bizarro, is targeting customers of 70 banks scattered throughout Europe and South America, researchers said. According to an analysis from Kaspersky released Monday, Bizarro is a mobile malware, aimed at capturing online-banking credentia...
Authenticated account enumeration in sharing dialog - ownCloud
The sharing dialog implements a user enumeration mitigation to prevent an authenticated user from getting a list of all accounts registered on the instance via the auto-complete dropdown. In the default configuration at least 3 characters of the name or email of the share-receiver “Sharee” must...
CITSmart SQL Injection Vulnerability
CITSmart is an application from CITSmart Portugal. It provides all the processes for designing an organization. A SQL injection vulnerability exists in CITSmart versions prior to 9.1.2.28, which stems from the incorrect handling of "filtro de autocomplete...". No details of the vulnerability are...
CVE-2021-28142
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...
CVE-2021-28142
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...
CVE-2021-28142
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...
CVE-2021-28142
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...
CITSmart SQL注入漏洞
CITSmart is an application from CITSmart Portugal. It provides all the processes for designing an organization. A SQL injection vulnerability exists in CITSmart versions prior to 9.1.2.28, which stems from the incorrect handling of "filtro de autocomplete...". No details of the vulnerability are...
PT-2021-18158 · Redmine · Redmine
Name of the Vulnerable Software and Affected Versions: Redmine versions 4.1.0 through 4.1.1 Description: The issue arises from the mishandling of an issue's subject in the auto complete tip, leading to a potential XSS attack. Recommendations: For versions 4.1.0 through 4.1.1, update to version...
Redmine 跨站脚本漏洞
Redmine is a set of open source Web-based project management and defect tracking tools . The product provides features such as project management, issue tracking and role-based access control. A security vulnerability exists in Redmine 4.1.x before 4.1.2, which stems from the subject of an issue...
DRUPAL-CONTRIB-2021-005
The Fast Autocomplete module provides fast IMDB-like suggestions below a text input field. Suggestions are stored as JSON files in the public files folder so that they can be provided to the browser relatively fast without the need for Drupal to be bootstrapped. The module doesn't correctly...
Fast Autocomplete - Moderately critical - Access bypass - SA-CONTRIB-2021-005
The Fast Autocomplete module provides fast IMDB-like suggestions below a text input field. Suggestions are stored as JSON files in the public files folder so that they can be provided to the browser relatively fast without the need for Drupal to be bootstrapped. The module doesn't correctly...
Security Bulletin: Netcool Operations Insights - login.jsp Caching issues and autocomplete for password field enabled. (low)
Summary It was observed that the Netcool Operations Insights Omnibus Webgui login.jsp was caching password fields and that the autocomplete attribute was not disabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...
Security Bulletin: IBM Maximo Data Loader (maxloader) shipped with IBM Maximo for Civil Infrastructure is vulnerable to autocomplete HTML Attribute not disabled for password field
Summary There is autocomplete HTML attribute not disabled for password field in Maximo Data Loader maxloader which is shipped with IBM Maximo for Civil Infrastructure. It may be possible to bypass the web application's authentication mechanism. Vulnerability Details CVEID: CVE-2021-20445...
Yelp: password field autocomplete enabled
Summary: Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local...
OPENSUSE-SU-2020:1509-1 Recommended update for otrs
Otrs was updated to 5.0.42, fixing lots of bugs and security issues: https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo1168029 OSA-2020-10: Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset tokens,...
openSUSE Security Update : otrs (openSUSE-2020-1475)
Otrs was updated to 5.0.42, fixing lots of bugs and security issues : https://community.otrs.com/otrs-community-edition-5s-patch-level-42/ - CVE-2020-1773 boo1168029 OSA-2020-10 : - Session / Password / Password token leak An attacker with the ability to generate session IDs or password reset...