CVE-2022-46868

CVE-2022-46868 affects Acronis Cyber Protect Home Office for Windows prior to build 40173. The issue is a local privilege escalation during recovery caused by improper soft link handling, enabling an attacker to elevate privileges. The advisory details the vulnerable software/versions and the imp...

PT-2023-5804 · Acronis · Acronis Cyber Protect Home Office

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Home Office Windows versions before build 40173 Description: The issue is related to local privilege escalation during recovery due to improper soft link handling. This could allow an attacker to elevate their privileges...

Acronis Cyber Protect 安全漏洞

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Singapore. It combines backup, anti-malware, cybersecurity and endpoint management features such as vulnerability assessment, URL filtering, patch management, and more. A security vulnerabili...

GHSA-VMF9-6PCV-XR87 Withdrawn Advisory: Username enumeration attack in goauthentik

Withdrawn Advisory This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references. Original Description Summary Using a recovery flow with an identification stage an attacker is able to determine if a username exists. Impact Onl...

Withdrawn Advisory: Username enumeration attack in goauthentik

Withdrawn Advisory This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references. Original Description Summary Using a recovery flow with an identification stage an attacker is able to determine if a username exists. Impact Onl...

Design/Logic Flaw

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522

goauthentik (open‑source Identity Provider) contains a vulnerability in affected versions using a recovery flow with an identification stage that allows an attacker to determine whether a username exists, enabling username/email enumeration. The issue affects setups with the recovery flow and can...

CVE-2023-39522 Username enumeration attack in goauthentik

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522 Username enumeration attack in goauthentik

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522 Username enumeration attack in goauthentik

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. A security vulnerability exists in goauthentik versions prior to 2023.6.1 and prior to 2023.5.5, which stems from the use of a recovery process with an identification phase, which can be exploited by an...

PT-2023-26994

Name of the Vulnerable Software and Affected Versions goauthentik versions prior to 2023.5.6 goauthentik versions prior to 2023.6.2 Description The issue affects goauthentik, an open-source Identity Provider, where an attacker can determine if a username exists using a recovery flow with an...

Spoofing

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange...

CVE-2023-40757

User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40767

User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40760

User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40765

User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40762

User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40758

User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40759

User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...