User Enumeration via /QueryComponentRendererValue!Default.jspa endpoint - CVE-2020-36289

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. This vulnerability was discovered by Mikhail Klyuchnikov of Positive Technologies. The...

CVE-2020-14181

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0...

WordPress User Enumeration

In default WordPress installation there are several methods to enumerate authors username. These WordPress users can then be used in brute-force attacks against WordPress login page to guess passwords. No source data...

CVE-2020-24008

Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2020-24008

Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2020-24008

Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2020-24008

CVE-2020-24008 affects Umanni RH 1.0. A user enumeration flaw exists in the password recovery flow: messages differ between valid and invalid usernames, potentially enabling brute‑force attempts against valid users. Connected sources do not provide concrete remediation details or explicit exploit...

SAP NetWeaver AS ABAP and ABAP Platform Information Disclosure Vulnerability (CNVD-2020-48590)

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in the SOA Configuration Tracking component in SAP NetWeaver AS...

[20201105] - Core - User Enumeration in backend login

Improper handling of the username leads to a user enumeration attack vector in the backend login page...

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

PT-2020-5169 · Sap · Sap Netweaver +2

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform versions 702, 730, 731, 740, 750 Description: The issue is related to improper access control in the SOA Configuration Trace component, allowing any authenticated user to enumerate all SAP users. Th...

Exploit for Injection in Apache Archiva

CVE-2020-9495 PoC CVE-2020-9495 is medium severity LDAP injec...

CVE-2020-11625

CVE-2020-11625 affects AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. The issue arises from ISAPI/Security/sessionLogin/capabilities responses that reveal whether a submitted username exists: a valid username r...

TYPO3 10.4.x < 10.4.2 Information Disclosure (TYPO3-CORE-SA-2020-001)

The version of TYPO3 installed on the remote host is 10.4.x prior to 10.4.2. It is, therefore, affected by an information disclosure vulnerability in its password reset component due to a failure to defend against time-based attacks. An unauthenticated, remote attacker can exploit this, to...

Responsive Online Blog 1.0 SQL Injection

Exploit Title: Responsive Online Blog 1.0 - 'single.php?id=' SQL Injection Date: 2020-07-03 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

Design/Logic Flaw

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...