CVE-2019-20032

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem...

nontonfilm168.me Cross Site Scripting vulnerability OBB-1227094

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

seat4.me Cross Site Scripting vulnerability OBB-1192832

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PHPCMS me***.php page suffers from SQL injection vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. A SQL injection vulnerability exists in the PHPCMS me.php page, which can be exploited by attackers to obtain sensitive information from the database...

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

Awesome-shiro CVE-2016-4437 Shiro=1.2.4 deserialization,...

DNF Pocket Android version of Chengdu I Fun Technology Co. Ltd. suffers from denial-of-service vulnerability

DNF Pocket Android is a Dungeons & Dragons game profile search application designed for Android users. There is a denial-of-service vulnerability in DNF Pocket Game Treasure Android version by Chengdu Me Fun Technology Co. An attacker can exploit the vulnerability to cause the program to crash...

t33.rsp4.me Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1153668 Security Researcher atmon3r Helped patch 228 vulnerabilities Received 5 Coordinated Disclosure badges Received 14 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting t33.rsp4.me website and its...

CVE-2019-1003003

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...

shiro: Cookie padding oracle vulnerability with default configuration

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack...

SQL Injection Vulnerability in UQCMS Cloud Business System me***.cl***.php Page

UQCMS cloud business system is the program using PHP + MYSQL template using smarty template, front and back end is separated from a B2B2C e-commerce software. UQCMS cloud business system me.cl.php page SQL injection vulnerability exists. An attacker can exploit this vulnerability to obtain...

Insecure Session Management

Symfony uses an insecure session management. An attacker is able to authenticate as a privileged user on sites with user registration and the remember me login functionality enabled...

Improper authentication in Symfony

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/securit...

GHSA-R679-M633-G7WC Improper input validation in Apache Shiro

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack...

Harded Coded Remember-Me Cookie

Opencast uses a harded coded remember-me cookie. The remember-me cookie is created by hashing the username, password, and an additional system key, allowing anyone with an access to the remember-me token for one server to compromise all servers using the same credentials...

Authentication Bypass

opencast-kernel is vulnerable to authentication bypass. The vulnerability exists as a fake remember-me token can be used to gain access of arbitrary users without the need to be authenticated...

CVE-2020-5206

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...

Authentication flaw

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...

CVE-2020-5206

Opencast prior to versions 7.6 and 8.1 was vulnerable to an authentication bypass: a fake remember-me token could be accepted as a valid login for a user (even if the token was incorrect) because the attacked endpoint allowed anonymous access. This could let an attacker impersonate a user, includ...

CVE-2020-5206 Authentication Bypass For Endpoints With Anonymous Access in OpenCast

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...

GHSA-MH8G-HPRG-8363 Hard-Coded Key Used For Remember-me Token in Opencast

Impact The security configuration in etc/security/mhdefaultorg.xml enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring th...