4676 matches found
CVE-2021-3513
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality...
CVE-2021-24232 Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...
PT-2021-15776
Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar WordPress plugin versions prior to 1.6.8 Description: The issue is related to an authenticated reflected Cross-Site Scripting problem. This occurs because the license error message is not properly sanitized when it i...
CVE-2021-24232: Improper Neutralization of Input During Web Page Generation
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue...
Information disclosure
The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an...
Mac Receiver Launches Application and Closes Abruptly
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. User is unable to log on from a MacBook using the Citrix Receiver for Mac. The session opens and...
Atlassian Jira Server & Data Center 安全漏洞
Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia, Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA, which is a security vulnerability that could be...
PT-2021-16942
Name of the Vulnerable Software and Affected Versions Jira Server and Data Center versions prior to 8.5.12 Jira Server and Data Center versions 8.6.0 through 8.13.4 Jira Server and Data Center versions 8.14.0 through 8.15.1 Description The Jira importers plugin AttachTemporaryFile rest resource...
CVE-2021-3393: Generation of Error Message Containing Sensitive Information
An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. A...
Code injection
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message...
CVE-2021-3391: Undefined Security Weakness
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message...
Citrix PVS: Target Devices giving error message "login request timed out " after Power Outage
After an interruption in service, some target devices are giving an error "login request timed out"...
GitLab EE Information Disclosure Vulnerability (CNVD-2021-22909)
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. GitLab EE has an information disclosure vulnerability. The...
"Http/1.1 Internal Server Error 43531" when accessing Citrix Gateway after upgrading to version 13.0
Users will get the error "Http/1.1 Internal Server Error 43531" The ns.log will give error as below: Dec 23 14:52:26 , aaainfo flags 11 flags2 0, new webview 0, sess flags2 0, flags3 0 flags4 400 ssoDomain , ssoUsername: , ssoUsername2: " Dec 23 14:52:26 XXX.XXX.X.XXX 12/23/2020:19:52:26 GMT...
PT-2021-14884 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.4 and later Description: An issue was identified that leaked internal IP address via error messages. Recommendations: For GitLab EE versions 13.4 and later, at the moment, there is no information about a newer version th...
CVE-2021-22169: Generation of Error Message Containing Sensitive Information
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages...
SAML + LDAP using Nfactor gives error "You are not allowed to login. Please contact your administrator"
After hitting Netscaler for login, you are redirected to SAML and successfully login. Afterwards, you are redirected back to Netscaler and receive the error"You are not allowed to login. Please contact your administrator"...
Unable to Open Attachment in SecureMail More Than Certain Size
When attempting to open an attachment in Secure Mail which is greater than 'x' MB, it fails to open. The following error appears: "Sorry. There was a problem downloading this file" Example: Attachment 10MB or greater fails to open However, attachment with 9 MB or smaller size opens without any is...
Exploit for Generation of Error Message Containing Sensitive Information in Zohocorp Manageengine_Servicedesk_Plus_Msp
Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User...
HackerOne: Used email confirmation link reveals the email address which is tied to it
Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...