4024 matches found
Sql injection
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP...
CVE-2020-28413
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP...
CVE-2020-28413
CVE-2020-28413 affects MantisBT 2.24.3, where the SQL injection occurs in the parameter “access” of the mc_project_get_users function via the SOAP API. The vulnerability is triggered remotely over the network with low attack complexity, as indicated by the CVSS vectors (v3.1: AV:N/AC:L/PR:L/UI:N/...
CVE-2020-28413
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP...
Debian: Security Advisory (DSA-4818-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4818-1 : sympa - security update
Several vulnerabilities were discovered in Sympa, a mailing list manager, which could result in local privilege escalation, denial of service or unauthorized access via the SOAP API. Additionally to mitigate CVE-2020-26880 the sympanewaliases-wrapper is no longer installed setuid root by default....
[SECURITY] [DSA 4818-1] sympa security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4818-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4818-1] sympa security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4818-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2020 https://www.debian.org/security/faq -...
Go365 - An Office365 User Attack Tool
Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office365 now/soon Microsoft365. Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the...
Debian DLA-2499-1 : sympa security update
Sympa, a modern mailing list manager, grants full SOAP API access by sending invalid string as the cookie value, if the SOAP endpoint was enabled. An attacker could manipulate the mailing lists, including subscribing e-mails or getting the list of subscribers. For Debian 9 stretch, this problem h...
Debian: Security Advisory (DLA-2499-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 2499-1] sympa security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2499-1 [email protected] https://www.debian.org/lts/security/ December 17, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...
Sympa < 6.2.60 SOAP API Vulnerability
Sympa is prone to an authentication bypass vulnerability in the SOAP API. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...
Authorization Bypass
sympa is vulnerable to authorization bypass. The vulnerability exists as remote attackers can obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...
CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...
DEBIAN-CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...
CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...
Code injection
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...
