131 matches found
PT-2022-03: Stored Cross-Site Scripting (XSS)
Since the Site Configuration tool has an upload option, it doesn’t validate the file contents. An attacker can upload a Zip file which, when processed, exploits Stored XSS. The attack can only be performed by an internal user. NetAct 22 SP1037 is already delivered on top of NetAct 22 FP2208, SP...
GHSA-FJ69-P8F6-Q97H Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions prior to 2.2.5 and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable onl...
SiPass integrated access control vulnerability (CNVD-2021-100377)
SiPass integrated is an access control system. With the SiPass integrated access control vulnerability, an affected application has insufficiently restricted access to internal user authentication services. A remote attacker could exploit the vulnerability to trigger multiple operational accounts...
Unspecified Vulnerability in Couchbase Server
Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . Couchbase Server has a security vulnerability that can be exploited by an attacker ...
Design/Logic Flaw
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @nsserver, leaks credentials in cleartext in the cbcollectinfo.log, debug.log, nscouchdb.log, indexer.log, and stats.log files. NOTE:...
Couchbase Server 安全漏洞
Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . Couchbase Server has a security vulnerability that can be exploited by an attacker ...
CVE-2019-14477
AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted...
AdRem NetCrunch Trust Management Issues Vulnerability
Adrem Netcrunch is a device monitoring software from the American company Adrem. The software monitors Windows, Linux, Mac OS X, BSD, NetWare, and SNMP devices based on SNMP sources, Windows event logs, and Syslog servers. AdRem NetCrunch 10.6.0.4587 suffers from a Trust Management Issue...
CVE-2020-24034
Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...
Genius Bytes Genius Server usrInternalUsrCRUD plugin elevation of privilege vulnerability
Genius Bytes Genius Server is a set of data platforms for connecting IT infrastructure components from Genius Bytes Germany. usrInternalUsrCRUD is one of the internal user CRUD Create, Read, Update and Delete plug-ins. A security vulnerability exists in the usrInternalUsrCRUD plugin in Genius Byt...
CVE-2019-13421
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
CVE-2019-13420
Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...
CVE-2019-13421
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
Default credentials
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
CVE-2019-13421
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...
CVE-2019-13420
Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...
CVE-2019-13420
Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...
Code injection
Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...
CVE-2019-13420
CVE-2019-13420 affects floragunn Search Guard (Elasticsearch/ELK plugin) prior to version 21.0. The vulnerability is a timing side-channel in the internal user database, which could leak information and impact confidentiality. The detail provided specifies the root cause as a timing discrepancy w...