Cisco Software Maintenance Update Enumeration

It is possible to enumerate the installed Cisco Software Maintenance Updates on the remote Cisco device using the 'show install active' or 'show version' command. TRUSTED...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...

CVE-2019-4741

IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 172815...

Server side request forgery (ssrf)

IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 172815...

CVE-2020-2118

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

Design/Logic Flaw

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-2118

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-2118

CVE-2020-2118 concerns Jenkins Pipeline GitHub Notify Step Plugin (versions 1.0.4 and earlier). The issue is a missing permission check in form-related methods that lets users with Overall/Read access enumerate credentials IDs stored in Jenkins. This disclosure could facilitate credential harvest...

CVE-2019-20100

The Atlassian Application Links plugin is vulnerable to cross-site request forgery CSRF. The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version...

CVE-2019-20100

The Atlassian Application Links plugin is vulnerable to cross-site request forgery CSRF. The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version...

CVE-2019-20099

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery CSRF. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerat...

CVE-2019-20099

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery CSRF. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerat...

PT-2020-15325 · Jenkins · Jenkins Pipeline Github Notify Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier Description: A missing permission check in form-related methods of the Jenkins Pipeline GitHub Notify Step Plugin allowed users with Overall/Read access to enumerate...

CVE-2020-3933

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system...

CVE-2020-3933

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system...

Design/Logic Flaw

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system...

CVE-2020-3933 TAIWAN SECOM CO., LTD. - User Account Enumeration

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system...

Security Bulletin: IBM Content Navigator is vulnerable to Server Side Request Forgery (SSRF)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4741 DESCRIPTION: IBM Content Navigator is vulnerable to Server Side Request Forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system,...

CSRF in Application Links plugin allows network enumeration - CVE-2019-20100

Atlassian Jira Server and Data Center before version 8.7.0 use a version of the Atlassian Application Links plugin that is vulnerable to cross-site request forgery CSRF. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to...

CSRF in VerifyPopServerConnection!add.jspa - CVE-2019-20099

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery CSRF. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerat...