11765 matches found
CVE-2021-36200
CVE-2021-36200 affects Johnson Controls Metasys ADS/ADX/OAS with MUI, specifically versions 10 and 11. The vulnerability is missing authentication for a critical function, allowing an unauthenticated user to access the Metasys web API and enumerate users. CVSS v3 base score is 5.3 (AV:N/AC:L/PR:N...
LiveTargetsFinder - Generates Lists Of Live Hosts And URLs For Targeting, Automating The Usage Of MassDNS, Masscan And Nmap To Filter Out Unreachable Hosts And Gather Service Information
Generates lists of live hosts and URLs for targeting, automating the usage of Massdns, Masscan and nmap to filter out unreachable hosts Given an input file of domain names, this script will automate the usage of MassDNS to filter out unresolvable hosts, and then pass the results on to Masscan to...
@abacus-network/helloworld (>=0.2.1-alpha, <=0.2.1-beta2), @alt-research/orbit-sdk-avail (>=0.9.1, <=0.9.11) +108 more potentially affected by CVE-2022-31172 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.7.0)
@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.2.1-alpha, =0.9.1, =0.19.0-beta.0, =0.1.0-alpha, =0.24.2, =1.0.0-beta.1, =0.6.0-beta.0, =1.1.4-migration-beta.0, =1.0.0-beta.0, =1.0.0-upstream-0.19.0, =1.4.0, =1.5.0-beta.0 and more Source cves: CVE-2022-31172 Source advisory:...
CVE-2021-36200
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users...
Johnson Controls Metasys ADS, ADX, OAS
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc Equipment: Metasys ADS, ADX, OAS with MUI Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...
IBM Sterling Partner Engagement Manager Server-Side Request Forgery Vulnerability
IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A server-side request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the product's failure to properly validate user input and could be exploited by an authenticated...
The vulnerability of the Apache Tomcat application server’s Realm implementation, related to information disclosure due to mismatches, allows attackers to determine all existing user names.
The vulnerability of the Apache Tomcat application server’s Realm implementation is related to the exposure of information through mismatches. Exploiting this vulnerability allows a remote attacker to discover all existing user names...
CVE-2022-22416
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
Server side request forgery (ssrf)
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
CVE-2022-22416
IBM Sterling Partner Engagement Manager is affected by CVE-2022-22416 (SSRF) in versions 6.1.2, 6.2, and Cloud/SaaS 22.2. The root cause is input validation failure that allows an authenticated attacker to cause the system to issue unauthorized requests, potentially enabling network enumeration a...
CVE-2022-22416
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
IBM Sterling Partner Engagement Manager 代码问题漏洞
IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A server-side request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the product's failure to properly validate user input and could be exploited by an authenticated...
CVE-2022-22416
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
CVE-2022-26656
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join...
CVE-2022-26656
CVE-2022-26656 affects Pexip Infinity prior to 27.3. The vulnerability is described across multiple sources as an input validation error in the One Touch Join flow that can allow remote attackers to trigger a software abort and potentially enumerate usernames. Concrete affected product/version: P...
Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool
ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin @0xTas. I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity tooling in general. ZenBuster may not be the fastest or most...
Pexip Infinity 安全漏洞
Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from Pexip, a Norwegian company. Pexip Infinity is vulnerable to an input validation error that could be exploited by an attacker to trigger a software abort via One Touch Joi...