Security Bulletin: A vulnerability has been identified in IBM WebSphere Liberty shipped with IBM Tivoli Netcool Impact (CVE-2021-29842)

Summary IBM WebSphere Liberty is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting affecting IBM WebSphere Liberty has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application...

PT-2022-11502 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 14.6.5 GitLab CE/EE versions 14.7 through 14.7.4 GitLab CE/EE versions 14.8 through 14.8.2 Description: An issue has been discovered in GitLab CE/EE that may allow a remote, unauthenticated attacker to acces...

GitLab 13.0.x < 14.6.5, 14.7.x < 14.7.4, 14.8.x < 14.8.2 GraphQL API User Enumeration Vulnerability - Active Check

GitLab is prone to a user enumeration vulnerability via the GraphQL API. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

CVE-2021-4191: GitLab GraphQL API User Enumeration (FIXED)

On February 25, 2022, GitLab published a fix for CVE-2021-4191, which is an instance of CWE-359, "Exposure of Private Personal Information to an Unauthorized Actor." The now-patched vulnerability affected GitLab versions since 13.0. The vulnerability is the result of a missing authentication chec...

CVE-2022-22700: Use of Insufficiently Random Values

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant...

Gitlab -- multiple vulnerabilities

Gitlab reports: Runner registration token disclosure through Quick Actions Unprivileged users can add other users to groups through an API endpoint Inaccurate display of Snippet contents can be potentially misleading to users Environment variables can be leaked via the sendmail delivery method...

GitLab GraphQL API User Enumeration

This module queries the GitLab GraphQL API without authentication to acquire the list of GitLab users CVE-2021-4191. The module works on all GitLab versions from 13.0 up to 14.8.2, 14.7.4, and 14.6.5. Module Options msf use auxiliary/scanner/http/gitlab/graphqluserenum msf undefinedgraphqluserenu...

CVE-2022-24633

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...

CVE-2022-24633

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...

CVE-2022-24633

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...

Design/Logic Flaw

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...

FileCloud 信息泄露漏洞

FileCloud is an ultra-secure content collaboration platform from US-based FileCloud, Inc. offering industry-leading compliance, data governance, data leakage protection, data retention and digital rights management capabilities. FileCloud suffers from a security vulnerability that stems from the...

CVE-2022-24633

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...

CVE-2022-24633

CVE-2022-24633 concerns FileCloud software. All versions before 21.3 are vulnerable to user enumeration due to the path parameter handling in "/SHARED/". A malicious actor could determine whether a user exists by requesting share information for specific shares. The vulnerability impact is user e...

CVE-2022-24633: Exposure of Sensitive Information to an Unauthorized Actor

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/ ". A malicious actor could identify the existence of users by requesting share information on specified share paths...

PT-2022-16768

Name of the Vulnerable Software and Affected Versions FileCloud versions prior to 21.3 Description The issue allows for user enumeration. It exists in the path parameter when passing /SHARED/. A malicious actor could identify the existence of users by requesting share information on specified sha...

CVE-2022-0564: Observable Response Discrepancy

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

ServiceNow Orlando Username Enumeration

Exploit Title: ServiceNow - Username Enumeration Google Dork: NA Date: 12 February 2022 Exploit Author: Victor Hanna Trustwave SpiderLabs Author Github Page: https://9lyph.github.io/CVE-2021-45901/ Vendor Homepage: https://www.servicenow.com/ Software Link:...

Information Disclosure

snipe/snipe-it is vulnerable to information disclosure. A remote unauthenticated attacker is able to enumerate users through the response message in the password reset page to figure out on which email address to try a password brute-force attack and gain access to user credentials...

H3C SSL VPN Username Enumeration

H3C SSL VPN Username Enumeration Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd. Product web page: https://www.h3c.com Affected version: n/a Summary: H3C SSL VPN is a secure VPN system based on SSL connections. It allows mobile employees to access corporate networks remotel...