Design/Logic Flaw

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2023-46652

A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins...

CVE-2023-39219 Admin Console Denial of Service via Java class enumeration

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2023-39219 Admin Console Denial of Service via Java class enumeration

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

Jenkins Plugin lambdatest-automation Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Ping Identity PingFederate Resource Management Error Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. used for identity management. A security vulnerability exists in Ping Identity PingFederate that stems from the management console not responding to a request for a carefully crafted Java class load...

Pimcore User Enumeration

Pimcore versions before 10.1.3 suffer from an user enumeration vulnerability through the administration panel lost password feature. By submitting multiple usernames, a remote and unauthenticated attacker can infer the valid administrative accounts on the target Pimcore instance. No source data...

PT-2023-26837 · Ping Identity · Pingfederate Administrative Console

Name of the Vulnerable Software and Affected Versions: PingFederate Administrative Console affected versions not specified Description: The issue is related to a weakness in the PingFederate Administrative Console dependency, where the console becomes unresponsive due to crafted Java class loadin...

PT-2023-30143 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins lambdatest-automation Plugin versions 1.20.9 and earlier Description: A missing permission check in the Jenkins lambdatest-automation Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Zabbix vulnerabilities (USN-4767-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4767-1 advisory. Fu Chuang discovered that Zabbix did not properly parse IPs. A remote attacker could possibly use this issue to execute arbitrary...

Ubuntu 18.04 ESM / 20.04 ESM : Symfony vulnerabilities (USN-5290-1)

The remote Ubuntu 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5290-1 advisory. James Isaac and Mathias Brodala discovered that Symfony incorrectly handled switch users functionality. An attacker could possibly use this...

CVE-2023-38220 Full page cache enumeration via cookie X-Magento-Vary

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this...

Siemens Mendix Forgot Password Module Household Enumeration Vulnerability

The Mendix Forgot Password module allows your users to register your application or reset their own passwords without administrator involvement. A vulnerability exists in the Siemens Mendix Forgot Password module that can be exploited by an attacker to determine if a user is valid, allowing a bru...

CVE-2023-36127

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-36127

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-36127

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

Design/Logic Flaw

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-44399 ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting

ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...

CVE-2023-44399

CVE-2023-44399 — ZITADEL password reset information disclosure . The vulnerability affects ZITADEL versions 2.37.2 and earlier where an attacker could verify whether an account exists by abusing the password reset flow, even when the “Ignoring unknown usernames” setting is enabled. The root cause...

CVE-2023-43623

A vulnerability has been identified in Mendix Forgot Password Mendix 10 compatible All versions V5.4.0, Mendix Forgot Password Mendix 7 compatible All versions V3.7.3, Mendix Forgot Password Mendix 8 compatible All versions V4.1.3, Mendix Forgot Password Mendix 9 compatible All versions V5.4.0...