CUJO Firewall User Enumeration / Authorization Bypass Vulnerabilities

Exploit for multiple platform in category local exploits Despite CUJO Firewall is a cute device and quite challenging to break from hardware hacking point of view... the APIs which are just a click away, once bypassed pinning and apk's obfuscation suffer of authorization bypass issues. An attacke...

Security Bulletin: IBM Flex System Manager (FSM) is affected by vulnerability (CVE-2013-5423)

Summary IBM Flex System Manager FSM is affected by a vulnerability that could allow for a user enumeration attack. Vulnerability Details Abstract IBM Flex System Manager FSM is affected by a vulnerability that could allow for a user enumeration attack. Content Vulnerability Details: CVE-ID:...

Unauthenticated AWS Role Enumeration (IAM Revisited)

The post Unauthenticated AWS Role Enumeration IAM Revisited appeared first on Rhino Security Labs...

Information Disclosure

openssh is vulnerable to information disclosure attacks. The vulnerability exists as sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users ...

Nextcloud: WordPress vulnerable to multiple attacks at https://nextcloud.com

summary: your current version of WordPress is available to multiple attacks check INFO.php available attacks: - Unauthenticated Arbitrary File Deletion - lib/IPTraf.php User-Agent Header Stored XSS - Password Creation Restriction Bypass - wp-admin/admin.php whois Parameter Stored XSS - XSS & IAA ...

Nextcloud: Password authentication at newsletter.nextcloud.com discloses username list

summary: A vulnerability classified as problematic has been found in OpenSSH 7.2p2. check INFO.pngAffected is an unknown function of the component Authentication. The manipulation of the argument Password with an unknown input leads to a information disclosure vulnerability Username. CWE is...

EulerOS 2.0 SP5 : openssh (EulerOS-SA-2019-1008)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the...

BMC Network Automation 8.7.00.000 Session Hijacking

Intro: The BMC Network Automation allows authenticated users to hijack established remote sessions of other users, version v8.7.00.000 b383 u038 was confirmed to be vulnerable. Details: Authenticated users of the BMC Network Automation web application with assigned aviewera role are able to hijac...

Liberapay: User Enumeration

@offgouvea reported a user enumeration issue. User enumerations are out-of-scope as mentioned in our program's policy...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

Code injection

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

CVE-2018-18602

The CVE-2018-18602 issue pertains to Guardzilla smart cameras where the Cloud API allows user enumeration, enabling arbitrary camera access and monitoring. Affected software appears to be the Guardzilla Cloud API and associated Guardzilla cameras. The root cause described across sources is user e...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

PT-2018-14539 · Guardzilla · Guardzilla

Name of the Vulnerable Software and Affected Versions: Guardzilla smart cameras affected versions not specified Description: The issue allows user enumeration, which can result in arbitrary camera access and monitoring. Recommendations: At the moment, there is no information about a newer version...

EulerOS Virtualization 2.5.1 : openssh (EulerOS-SA-2018-1411)

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user unt...

EulerOS Virtualization 2.5.2 : openssh (EulerOS-SA-2018-1413)

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user unt...

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2018-1431)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the...

WordPress JobCareer premium theme <= 2.4 - User enumeration & Password Reset vulnerabilities

User enumeration & Password Reset vulnerabilities found by Anthony MAESTRE in WordPress JobCareer premium theme versions = 2.4. Solution Update the WordPress JobCareer premium theme to the latest available version at least 2.4.1...

Microsoft Windows - MsiAdvertiseProduct Arbitrary File Copy/Read Exploit

Exploit for windows platform in category local exploits The bug is in “MsiAdvertiseProduct” Calling this function will result in a file copy by the installer service. This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while...