4679 matches found
Code injection
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
CVE-2019-6122
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
CVE-2019-6122
CVE-2019-6122 is a vulnerability in NiceHash Miner prior to 2.0.3.0 causing user enumeration through separate error messages: submitting a non-existent email triggers “EMAIL DOES NOT EXIST,” while valid emails with incorrect credentials yield a different error. This behavioral difference enables ...
PT-2019-17965
Name of the Vulnerable Software and Affected Versions NiceHash Miner versions prior to 2.0.3.0 Description A Username Enumeration via Error Message issue was discovered because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different...
CVE-2019-6122: Generation of Error Message Containing Sensitive Information
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
CPDoS Poisoning Attack
On October 22, 2019, a new method of web cache poisoning, called CPDoS or Cache Poisoned Denial of Service, was announced by researchers, Hoai Viet Nguyen and Luigi Lo Iacono. Targeting content delivery networks and other caching systems, the attack works by using a malicious header in the HTTP...
CVE-2019-4512
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554...
Information disclosure
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554...
CVE-2019-4512
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554...
CVE-2019-4512: Generation of Error Message Containing Sensitive Information
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554...
Description of the security update for SharePoint Server 2019: October 8, 2019
None None...
CVE-2009-0842
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink...
Unable to unlock iOS or iPadOS devices via Administration Console after upgrading to 13.1
Unable to unlock iPhone/iPad from Citrix Endpoint Management administration console after upgrading to iOS/iPadOS 13.1+. Note:No error message is displayed when command fails. The device ignores the command...
CVE-2019-12156
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293...
PT-2019-12665
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2018.2.5 JetBrains UpSource versions prior to 2018.2 build 1293 Description The issue allows server metadata to be exposed due to an error message that reflects the whole response back to the client...
CVE-2019-12156: Generation of Error Message Containing Sensitive Information
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293...
Cross site scripting
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules...
Stored XSS vulnerability in log-parser
log-parser did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission. Jenkins applies the...
Cross site scripting
An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message...
CVE-2019-15086: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message...