2137 matches found
SNMP Windows Username Enumeration
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SNMP Windows Username Enumeration', 'Description' = ' This module will use LanManager/psProcessUsername OID values to enumerate local user accoun...
CVE-2024-41657
Technical details about CVE-2024-41657 are not publicly provided in the connected documents. Monitor for updates from vendors and advisories.
Security Bulletin: IBM License Key Server Administration and Reporting Tool, and its Agent is vulnerable to Password Exposure via UI inspection
Summary A vulnerability in IBM License Key Server Administration and Reporting Tool, and Agent allowed users' stored passwords to be exposed through the browser's console. This issue could potentially lead to unauthorized access to user accounts if an attacker gained access to the logged-in user'...
CVE-2024-25633
eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...
Hackers Leak 1.4 Billion Tencent User Accounts Online
Massive data leak exposes 1.4 billion Tencent user accounts. Leaked data includes emails, phone numbers, and QQ IDs…...
Rockwell Automation DataMosaix Private Cloud
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : DataMosaix Private Cloud Vulnerability : Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...
CVE-2024-41733
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...
CVE-2024-41733 Information Disclosure Vulnerability in SAP Commerce
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...
CVE-2024-41733
Concrete details from connected sources confirm a candidate vulnerability in SAP Commerce: an information-disclosure issue that allows an attacker to determine whether a given email is associated with a valid user account during registration or login. The impact is confined to confidentiality (lo...
CVE-2024-40480
CVE-2024-40480 affects Kashipara Online Exam System v1.0. The vulnerability is a Broken Access Control in /admin/update.php and /admin/dashboard.php that allows remote unauthenticated attackers to view the admin dashboard and delete valid user accounts via direct URL access. The issue is confirme...
CVE-2024-41432
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...
CVE-2024-41432
CVE-2024-41432 affects Likeshop up to 2.5.7.20210811. The issue is IP spoofing via forged X-Forwarded or Client-IP headers, enabling attackers to bypass admin login lockouts, spoof server requests, and impersonate other IPs tied to user sessions. No explicit fixes or patches are provided in the c...
The vulnerability of MicroLogix 1400 programmable logic controllers’ microprogramming software, related to deficiencies in authentication procedures, allows attackers to delete user accounts.
The vulnerability of MicroLogix 1400 programmable logic controllers’ microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to delete user accounts...
CVE-2023-40539
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-40644 gitoxide's gix-path can use a fake program files location
gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...
CVE-2024-6328
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebasesmslogin' and 'firebasesmsloginv2' functions...
CVE-2024-6328
CVE-2024-6328 – MStore API (WordPress plugin) authentication bypass . The WordPress plugin MStore API – Create Native Android & iOS Apps On The Cloud is vulnerable in all versions up to 4.14.7 due to insufficient verification on the phone parameter in firebase_sms_login and firebase_sms_login_v2,...
(Pwn2Own) Synology BC500 Improper Compartmentalization Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Synology BC500 cameras. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...
GHSA-529P-JJ47-W3M3 Decidim cross-site scripting (XSS) in the admin panel
Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...