11774 matches found
Code injection
An issue was discovered in Saviynt Enterprise Identity Cloud EIC 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI...
CVE-2022-23856
An issue was discovered in Saviynt Enterprise Identity Cloud EIC 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI...
CVE-2022-23856
CVE-2022-23856 affects Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. The issue is due to allowing an attacker to enumerate users by manipulating the id parameter in the ECM/maintenance/forgotpasswordstep1 endpoint. The vulnerability arises from improper validation/handling of the id paramete...
PT-2022-16294 · Saviynt · Saviynt Enterprise Identity Cloud
Name of the Vulnerable Software and Affected Versions: Saviynt Enterprise Identity Cloud EIC version 5.5 SP2.x Description: An issue was discovered that allows an attacker to enumerate users by changing the id parameter in the "ECM/maintenance/forgotpasswordstep1" API endpoint. Recommendations: F...
Saviynt Enterprise Identity Cloud 安全漏洞
Saviynt Enterprise Identity Cloud Saviynt Eic is a cloud-architected, cloud-deployed identity governance and management platform from Saviynt. A security vulnerability exists in Saviynt Enterprise Identity Cloud, which stems from an issue discovered in saviynt Enterprise Identity Cloud EIC 5.5...
GHSA-4XWW-6H7V-29JG User enumeration in livehelperchat
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not...
User enumeration in livehelperchat
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not...
in heroiclabs/nakama
Description It is possible to enumerate usernames via the Log-In function. Proof of Concept The login response provides information, whether the username is registered or not in the application. If the user is registered, and wrong password provided, the following information being displayed:...
Jenkins Permissions and Access Control Issues Vulnerability
Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins SSH Agent Plugin 1.23 previously had a security vulnerability that stemmed from a lack of privilege checking, whi...
Jenkins plugins Multiple Vulnerabilities (2022-01-12)
According to its their self-reported version number, the version of Jenkins plugins running on the remote web server are Jenkins Active Directory Plugin prior to 2.25.1, Badge Plugin prior to 1.9.1, Bitbucket Branch Source Plugin prior to 746., Configuration as Code Plugin prior to 1.55.1, Conjur...
OpenBMCS 2.4 - Server Side Request Forgery (SSRF) (Unauthenticated)
Exploit Title: OpenBMCS 2.4 - Server Side Request Forgery SSRF Unauthenticated Exploit Author: LiquidWorm Date: 26/10/2021 OpenBMCS 2.4 Unauthenticated SSRF / RFI Vendor: OPEN BMCS Product web page: https://www.openbmcs.com Affected version: 2.4 Summary: Building Management & Controls System BMCS...
CVE-2019-11716
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNameswindow. Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes t...
Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin
Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used...
GHSA-9WXH-JJJ5-67CV Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs
Jenkins SSH Agent Plugin prior to 1.23.2 and 1.22.1 does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using...
CVE-2022-20620
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2022-20620
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2022-20620
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2022-20618
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...
Information disclosure
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...