11710 matches found
CVE-2023-50952 IBM InfoSphere Information Server server-side request forgery
IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 275774...
Metasploit Weekly Wrap-Up 06/28/2024
Unauthenticated Command Injection in Netis Router This week's Metasploit release includes an exploit module for an unauthenticated command injection vulnerability in the Netis MW5360 router which is being tracked as CVE-2024-22729. The vulnerability stems from improper handling of the password...
CVE-2024-38322
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869...
CVE-2024-38322
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869...
CVE-2024-38322 IBM Storage Defender information disclosure
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869...
CVE-2024-38322
CVE-2024-38322 affects IBM Storage Defender – Resiliency Service, versions 2.0.0–2.0.4. The issue is an agent username/password error response discrepancy that can expose the product to brute‑force credential enumeration. Impact is described as potential data confidentiality impact; CVSS data pre...
CVE-2024-38322 IBM Storage Defender information disclosure
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869...
GO-2024-2508 Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault
Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault...
Storefront - Event ID 3005 - The request queue limit of the session is exceeded
When a user attempts to enumerate using the StoreWeb URL in a browser, not all icons are not enumerated. This can also occasionally result in enumeration failure and an error stating "Cannot complete your request" during enumeration. On the Storefront server, Windows Event Viewer Applications and...
LoLLMs Security Vulnerabilities
LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version 9.6 that stems from vulnerability to a path traversal attack, which allows an attacker to write an audio file to an arbitrary location on the...
MS-NRPC Domain Users Enumeration
This module will enumerate valid Domain Users via no authentication against MS-NRPC interface. It calls DsrGetDcNameEx2 to check if the domain user account exists or not. It has been tested with Windows servers 2012, 2016, 2019 and 2022. Module Options msf use auxiliary/scanner/dcerpc/nrpcenumuse...
CVE-2024-5862 User Enumeration in Mia Technology's Mia-Med Health Aplication
Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This issue affects Mia-Med Health Aplication: before 1.0.14...
CVE-2024-5862 User Enumeration in Mia Technology's Mia-Med Health Aplication
Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This issue affects Mia-Med Health Aplication: before 1.0.14...
AdminerEvo Code Issue Vulnerability
AdminerEvo is an AdminerEvo open source database management tool in a single PHP file. A security vulnerability exists in AdminerEvo. A remote attacker could exploit the vulnerability to enumerate or access otherwise inaccessible systems...
PT-2024-6224
Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6 Description The issue allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. This is due to the...
User Enumeration
silverstripe/framework is vulnerable to User Enumeration. The vulnerability is due to a timing attack on the login or password reset pages, allowing an attacker to determine the existence of user credentials based on response times...
IBM Db2 User Enumeration Vulnerability
IBM Db2 is a relational database management system from International Business Machines IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. A user enumeration vulnerability exists in IBM Db2 for i versions 7.2, 7.3, 7.4, and 7.5, which stems...
Malvertising Campaign Leads to Execution of Oyster Backdoor
The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...
SPA-CART CMS 1.9.0.6 Username Enumeration / Business Logic Flaw
Exploit Title: Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 Date: 6/2024 Exploit Author: Andrey Stoykov Version: 1.9.0.6 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html Description - It was found that the applicatio...