CVE-2020-2188

A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System

Summary Open Source OpenSSH is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an...

PT-2020-15402 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: A missing permission check in form-related methods of the Jenkins Amazon EC2 Plugin allows users with Overall/Read access to enumerate credentials IDs of credentials stored in...

NEC Electra Elite IPK II WebPro 01.03.01 Session Enumeration

Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration

Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Exploit

Exploit for hardware platform in category web applications Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session...

Tiny File Manager path traversal vulnerability (CNVD-2020-27486)

Tiny File Manager is a web-based open source file manager. Tiny File Manager path traversal vulnerability. An attacker can use this vulnerability to enumerate directories and files on the file system...

Protecting your organization against password spray attacks

When hackers plan an attack, they often engage in a numbers game. They can invest significant time pursing a single, high-value target—someone in the C-suite for example and do “spear phishing.” Or if they just need low-level access to gain a foothold in an organization or do reconnaissance, they...

Linux Gather HexChat/XChat Enumeration

This module will collect HexChat and XChat's config files and chat logs from the victim's machine. There are three actions you may choose: CONFIGS, CHATS, and ALL. The CONFIGS option can be used to collect information such as channel settings, channel/server passwords, etc. The CHATS option will...

Vulnerability Spotlight: Zoom Communications user enumeration

Video conferencing and calling software has spiked in popularity as individuals across the globe are forced to stay home due to the COVID-19 pandemic. There are a plethora of players in this space, with one or two getting increased attention. One service in particular — Zoom — has received an...

Brave Software: No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.org

There is no bruteforce protection here https://publishers.basicattentiontoken.org/publishers when i try to changes email's contact account. Also the actual thing is when I put an existing email in the above url's "publisherpendingemail" parameter I get an error response status 400 Bad Request But...

Zoom Communications Registered Users Enumeration

Summary Zoom doesn’t properly validate certain XMPP requests coming from the clients, which can lead to disclosure of details about registered users. Tested Versions Zoom Service As Of April 9th 2020 Product URLs https://zoom.us CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE...

Improper authorization on /rest/project-templates/1.0/createshared endpoint - CVE-2020-4029

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint. Affected versions: version 8.5.5 8.6.0 ≤ version 8.7.2 8.8.0 ≤ version...

Improper authorization on /rest/project-templates/1.0/createshared endpoint - CVE-2020-4029

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project names via an improper authorization vulnerability in the /rest/project-templates/1.0/createshared endpoint API endpoint. Affected versions: version 8.5.5 8.6.0 ≤ version 8.7.2 8.8.0 ≤ version...

Server side request forgery (ssrf)

IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 176404...

CVE-2020-4294

IBM QRadar SIEM (7.3.0–7.3.3 Patch 2) is vulnerable to Server-Side Request Forgery via the RssFeedItem component due to missing URL validation, potentially allowing an authenticated attacker to send unauthorized requests from the appliance (network enumeration or further attacks). Root cause: lac...

Adobe Digital Editions File Enumeration Vulnerability

Adobe Digital Editions DE is a set of e-book reading management software from the American company Audobee Adobe. The software supports open, read and manage PDF, XML, Flash and other formats. Adobe Digital Editions has a security vulnerability. An attacker can exploit the vulnerability to obtain...

Adobe Digital Editions Information Disclosure Vulnerability (APSB20-23) - Windows

Adobe Digital Edition is prone to an information disclosure vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Domained - Multi Tool Subdomain Enumeration

A domain name enumeration tool The tools contained in domained requires Kali Linux preferred or Debian 7+ and Recon-ng domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots,...

User Enumeration

Overview Affected versions of this package are vulnerable to User Enumeration wolfSSL 4.3.0 has mulmod code in wceccmulmodex in ecc.c that does not properly resist timing side-channel attacks. Remediation Upgrade wolfssl to version 5.0.0 or higher. References - GitHub Gist - GitHub PR...