XWiki Information Disclosure Vulnerability (GHSA-35fg-hjcr-j65f)

XWiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

CVE-2022-23619

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been...

CVE-2022-23619: Exposure of Sensitive Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been...

PT-2022-16132

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.9 XWiki Platform versions prior to 13.4.1 XWiki Platform versions prior to 13.6RC1 Description The issue allows an attacker to guess if a user has an account on the wiki by using the "Forgot your password...

Command injection

An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature...

CVE-2019-9059: Improper Neutralization of Special Elements used in a Command

An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature...

PT-2019-19343

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.8 Description An issue allows command injection with an administrator account by modifying the path of the e-mail executable in Mail Settings. This is achieved by setting "sendmail" in the "Mailer" option and...

CVE-2018-1000549

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request...

PT-2018-9445

Name of the Vulnerable Software and Affected Versions Wekan version 1.04.0 Description The issue allows a remote attacker to perform a brute force attack to obtain valid usernames and email addresses via HTTP Request, exploiting the Email / Username Enumeration vulnerability in the 'Register' and...

CVE-2018-1000549: Exposure of Sensitive Information to an Unauthorized Actor

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request...

Kodak Insite Creative Workflow System SQL Injection

Hello ... While investigating a recent installation of Kodak's Insite Creative Workflow System for my current employer, an SQL Injection vulnerability was discovered in its "Forgot Your Password?" page. An example of this application can be seen on the Kodak site...