Design/Logic Flaw

A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-2202

A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-2202

CVE-2020-2202 affects CloudBees Jenkins Fortify on Demand Plugin versions 6.0.0 and earlier. A missing permission check in form-related methods allowed users with Overall/Read access to enumerate credentials IDs stored in Jenkins. The vulnerability could enable credential ID disclosure, which att...

PT-2020-15416 · Jenkins · Jenkins Fortify On Demand Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Plugin versions 6.0.0 and earlier Description: A missing permission check in form-related methods of the Jenkins Fortify on Demand Plugin allowed users with Overall/Read access to enumerate credentials ID of...

Users with Overall/Read access could enumerate credentials IDs in fortify-on-demand-uploader

fortify-on-demand-uploader provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions in fortify-on-demand-uploader 6.0.0 and earlier, allowing any user with Overall/Read permission to get a...

CVE-2020-4029

The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability...

CVE-2019-20412

The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types;...

CVE-2019-20412

The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types;...

Naviwebs Navigate CMS Authorization Issues Vulnerability

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A security vulnerability exists in the password recovery feature in Naviwebs Navigate CMS version 2.9 r1433, which originates from a notfound message being returned when the user name o...

CVE-2020-3798

Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration host or local network vulnerability. Successful exploitation could lead to information disclosure...

CVE-2020-3798

Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration host or local network vulnerability. Successful exploitation could lead to information disclosure...

Information disclosure

Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration host or local network vulnerability. Successful exploitation could lead to information disclosure...

CVE-2020-3798

CVE-2020-3798 affects Adobe Digital Editions, specifically version 4.5.11.187212 and earlier on Windows, which is vulnerable to a file enumeration (host or local network) flaw that could lead to information disclosure. The root cause is information-disclosure via file enumeration within the appli...

CVE-2020-3798

Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration host or local network vulnerability. Successful exploitation could lead to information disclosure...

Logic Flaw Vulnerability in Beijing Jinpan Library Refined Management Platform

Jinpan Refined Management Platform is a resource management system commonly used in universities and governmental and enterprise organizations nationwide, which consists of the management terminal of C/S architecture and the user terminals of C/S and B/S. It covers four major functional modules,...

CVE-2020-14016

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a notfound message when the provided username or email address does...

CVE-2020-14016

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a notfound message when the provided username or email address does...

Default credentials

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a notfound message when the provided username or email address does...

CVE-2020-14016

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a notfound message when the provided username or email address does...

CVE-2020-14016

CVE-2020-14016 affects Navigate CMS 2.9 r1433. The forgot-password feature allows password reset via username or email; the system returns a not_found message when no matching user exists, enabling user enumeration. This is the underlying issue; explicit exploitation details or in-the-wild activi...