Sql injection

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-15557

CVE-2019-15557 affects XM^online 2 User Account and Authentication server 1.0.0. All connected sources describe a SQL injection vulnerability exploitable via a tenant key, resulting in high impact (C:H/I:H/A:H per CVSS3) with network access and no authentication required. The root cause is a SQL ...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-5638 Rapid7 Nexpose Insufficient Session Management

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user...

Nextcloud: potential RCE and XSS via file upload requiring user account and default settings

potential RCE and XSS via file upload requiring user account and default settings Requirements 1. User account that can upload files NO admin 2. User account name on creation usually the same as on creation/displayed name 3. data directory inside of nextcloud server folder suggested by...

CVE-2019-1935

A vulnerability in Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account scpuser, which has default user...

CVE-2019-1935

A vulnerability in Cisco Integrated Management Controller IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account scpuser, which has default user...

Cloud Foundry UAA Cross-Site Scripting Vulnerability

UAA is a multi-tenant identity management service used in Cloud Foundry and can also be used as a standalone OAuth2 server. A cross-site scripting vulnerability exists in Cloud Foundry UAA versions prior to 74.0.0. An attacker can exploit this vulnerability to execute malicious JavaScript via a...

CVE-2019-1953 Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

Nextcloud: Username Enumeration

Hi, it is possible to determine the existence of a user account. It reveals username which can open new attack vectors. Version: Nextcloud 16.0.3 Request for existing account: GET /avatar/admin/80?v=-472 HTTP/1.1 Host: localhost:8084 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.14; rv:68....

Cloud Foundry UAA Security Bypass Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security bypass vulnerability exists in Cloud Foundry UAA, which can be exploited by attackers to bypass restrictions...

Nextcloud: Persistent XSS via filename in projects

CVSS ---- Medium 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Description ----------- Affected: Talk / Spreed 6.0.3 The name of a file is echoed without encoding when moving the mouse onto it in the projects tab of a conversation, leading to persistent XSS. A successful attack requires an...

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...

UACME - Defeating Windows User Account Control

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. System Requirements x86-32/x64 Windows 7/8/8.1/10 client, some methods however works on server version too. Admin account with UAC set on default settings required. Usage Run executable from command line:...

Cross-site Scripting (XSS)

mediawiki is vulnerable to cross-site scripting XSS. The attack is possible because it allows the creation of a page that does not correspond to any user, e.g User:Foo/bar.js. Subsequently, an attacker will be able to create an account User:Foo and create a malicious script bar.js, which causes t...

Information Disclosure

sonarqube is vulnerable to information disclosure. Improperly configured access controls of the API allows an attacker to discover valid user account logins...

Insecure Deserialization in TYPO3 CMS

It has been discovered that FormEngine and DataHandler are vulnerable to insecure deserialization. A valid backend user account is needed in order to exploit this vulnerability...

CVE-2019-9957

Stored XSS within Quadbase EspressReport ES ERES v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The XSS payload is stored by creating a new user account, and setting the username to an XSS payload. The stored payload c...