78 matches found
CVE-2022-44022
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
CVE-2022-44022
PwnDoc up to version 0.5.3 is affected by an authentication timing flaw that could allow remote attackers to enumerate valid user account names. Affected component is the authentication mechanism in PwnDoc (0.5.3 and earlier). The root cause is timing-based disclosure during login attempts, enabl...
PT-2022-27084 · Pwndoc · Pwndoc
Name of the Vulnerable Software and Affected Versions: PwnDoc versions 0.5.3 and earlier Description: The issue allows remote attackers to identify valid user account names by leveraging response timings for authentication attempts. Recommendations: For PwnDoc versions 0.5.3 and earlier, at the...
CVE-2022-44023
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...
CVE-2022-44023
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...
PT-2022-27085 · Pwndoc · Pwndoc
Name of the Vulnerable Software and Affected Versions: PwnDoc versions 0.5.3 and earlier Description: The issue allows remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. Recommendations: For PwnDoc versions 0.5.3 and earlier, at t...
CVE-2022-44022
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
CVE-2022-44023
PwnDoc through 0.5.3 is vulnerable to information disclosure: remote attackers can identify disabled user account names by exploiting differences in authentication response messages. Affected software is PwnDoc versions 0.5.3 and earlier. The exact root cause is not detailed in the connected docu...
CVE-2022-44023
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...
CVE-2022-44022
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
PwnDoc has an unspecified vulnerability
PwnDoc is an application. The penetration test report generator PwnDoc version 2021-04-22 and prior versions has a security vulnerability that stems from incorrect JSON Webtoken handling, which could be exploited by an attacker to cause incorrect access control...
CVE-2021-31590
PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...
CVE-2021-31590
PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...
Authentication flaw
PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...
CVE-2021-31590
PwnDoc (up to 0.4.0 as of 2021-08-23) contains a JWT handling flaw that enables improper access control. A valid JSON Web Token used for authentication/authorization can preserve admin privileges when a user is downgraded to “user,” and even after account deletion the attacker can access the admi...
CVE-2021-31590
PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...
PwnDoc 安全漏洞
PwnDoc is an application. The penetration test report generator PwnDoc version 2021-04-22 and prior versions has a security vulnerability that stems from incorrect JSON Webtoken handling, which could be exploited by an attacker to cause incorrect access control...
Pwndoc - Pentest Report Generator
PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Vulnerabilitie...