11687 matches found
Security Bulletin: IBM Security Guardium is affected by a SSRF vulnerability (CVE-2024-49336)
Summary IBM Security Guardium has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2024-49336 DESCRIPTION: IBM Security Guardium is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system,...
IBMi Navigator 7.5 - Server Side Request Forgery (SSRF)
Author Title: John Page aka hyp3rlinx Author Website: hyp3rlinx.altervista.org Source: https://hyp3rlinx.altervista.org/advisories/IBMiNavigatorHTTPSecurityTokenBypass-CVE-2024-51464.txt Vendor: www.ibm.com Vendor www.ibm.com Product Navigator for i is a Web console interface where you can perfor...
Perforce ALM 安全漏洞
Perforce ALM Helix ALM is an application lifecycle management software from Perforce. A security vulnerability exists in Perforce ALM versions prior to 2025.1 that stems from a different error response being returned during authentication, which could lead to username enumeration...
Citrix DaaS | Workspace expiration period forced Users to re-authenticate
When the user logs in to workspace URL, they are unexpected behavior while using CWA. -They will be prompted to keep themselves logged in due to a Inactive policy set. -Once they select keep me logged in, the workspace page gets refreshed and they don't see any apps or desktops...
AWS VDP: Non-Production API Endpoints for the Route 53 Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The non-production API endpoints for the Route 53 service failed to log to CloudTrail, resulting in silent permission enumeration. Two non-production endpoints were found that could be used with standard IAM credentials without logging to CloudTrail. This allowed an adversary to perform permissio...
Exploit for Improper Input Validation in Silverpeas
CVE-2025-46047 Silverpeas -u Example...
Exploit for CVE-2025-46047
CVE-2025-46047 Silverpeas -u Example...
Nagios Log Server 2024R1.3.1 - API Key Exposure
Exploit Title: Nagios Log Server 2024R1.3.1 - API Key Exposure Date: 2025-04-08 Exploit Author: Seth Kraft, Alex Tisdale Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link: https://www.nagios.com/products/log-server/download/...
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Impact User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials. This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+ References -...
GHSA-256Q-HX8W-XCQX Silverstripe Framework user enumeration via timing attack on login and password reset forms
Impact User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials. This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+ References -...
Observable Discrepancy
Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Observable Discrepancy. An attacker can enumerate users by performing a timing attack on the login or password reset pages with user credentials...
CVE-2025-30280
A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...
SS-2025-001 - User enumeration via timing attack
More info at https://www.silverstripe.org/download/security-releases/ss-2025-001...
CVE-2025-32373 DNN allows a registered user to enumerate and access files they should not have access to
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8...
CVE-2025-32373 DNN allows a registered user to enumerate and access files they should not have access to
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8...
Microsoft Windows Multiple Vulnerabilities (KB5055519)
This host is missing an important security update according to Microsoft KB5055519 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
GHSA-HH7J-6X3Q-F52H Shopware 6 allows attackers to check for registered accounts through the store-api
Impact Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response "errors":"status":"404","code":"CHECKOUTCUSTOMERNOTFOUND","title":"Not...
CVE-2025-30150
CVE-2025-30150 affects Shopware 6 platforms. The vulnerability allows an attacker using the store-api to determine whether an email address is registered by querying /store-api/account/recovery-password ; responses differentiate between found vs not found accounts, enabling information exposure. ...
CVE-2025-30280
A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...