Security Bulletin: Autocomplete not disabled for password field in IBM Content Navigator.

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details Third Party Entry: PSIRT-ADV0024961 DESCRIPTION: Created from Advisory: ADV0024961 CVSS Base score: 6.2 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products and Versions Affected...

Password field not displayed for published apps in Windows Server 2019

When publishing any O365 app such as Excel or Word, users are prompted to authenticate to Office 365 to activate the app. Password field is not rendered when the app is published so users can never authenticate. This also occurs with RDP initial app. Microsoft has reproduced the issue with using...

CVE-2014-3649

JBoss AeroGear has reflected XSS via the password field...

Cross site scripting

JBoss AeroGear has reflected XSS via the password field...

CVE-2014-3649

CVE-2014-3649 affects Red Hat/JBoss AeroGear and refers to a reflected XSS vulnerability in the password field. The root cause cited by CNVD is lack of proper validation of client-side data by the WEB application, enabling an attacker to execute client-side code in a victim’s browser. Public expl...

CVE-2014-3649

JBoss AeroGear has reflected XSS via the password field...

UBUNTU-CVE-2018-14668

In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "defaultdatabase" fields which led to Cross Protocol Request Forgery Attacks...

CEWE Photoshow 6.4.3 - 'Password' Denial of Service (PoC)

-- coding: utf-8 -- Exploit Title: CEWE PHOTO SHOW 6.4.3 - Denial of Service PoC Date: 16/05/2019 Author: Alejandra Sánchez Vendor Homepage: https://cewe-photoworld.com/ Software: https://cewe-photoworld.com/creator-software/windows-download Version: 6.4.3 Tested on: Windows 10 Proof of Concept:...

Password and token field in Receiver change after authenticating on Netscaler Gateway.

Password and token field in Receiver change their order after authenticating on NetScaler Gateway...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2018-13309

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

Beyond Remote 2.2.5.3 - Denial of Service (PoC)

Exploit Title: Beyond Remote 2.2.5.3 - Denial of Service PoC Author: Erenay Gencay Discovey Date: 2018-09-24 Vendor notified : 2018-09-24 Software Link: https://beyond-remote-client-and-server.jaleco.com/ Tested Version: 2.2.5.3 Tested on OS: Windows XP Professional sp3 ENG Steps to Reproduce: Ru...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03472)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'password' parameter of the users/registration page in...

CVE-2018-14668

“remote” table function allowed arbitrary symbols in “user”, “password” and “defaultdatabase” fields which led to Cross Protocol Request Forgery Attacks. Andrey Krasichkov of Yandex Information Security Team...

CVE-2018-7477

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

CVE-2017-11508

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...

[R1] SecurityCenter 5.6.0 Fixes One Vulnerability

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...

Moxa MXView 2.8 Denial Of Service

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: =========== MXView v2.8 Download:...

Web Based TimeSheet Script Authentication Bypass Vulnerability

web based timesheet is a program to monitor the work of your employees. An authentication bypass vulnerability exists in the Web Based TimeSheet script that requires the string 'or' '=' to be entered where the password is filled in, which can be exploited by an attacker to bypass authentication...

Nextcloud: Missing Rate Limit for Current Password field in nextcloud.com

There is no rate limit enabled for "Current Password" field on Setting page of nextcloud.com. A malicious minded user can continually tries to brute force an account password...