CVE-2017-16250

A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerate through user-ids which could be used to identify valid user ids and associated user names...

Shenzhen Yuanzheng Technology X431-PRO 3S Android APP has an overstepping vulnerability

X431-PRO 3S APP is a vehicle fault detection system. The X431-PRO 3S Android APP of Shenzhen Yuanzheng Technology has an overstepping vulnerability. The attacker logs into the system and modifies the user ID by grabbing packets to view any account information, including: user name, cell phone...

Shenzhen Armed Police Hospital's Android APP suffers from overstepping access vulnerability

"Shenzhen Armed Police Hospital" is the Shenzhen Armed Police Hospital official cell phone application software, designed to simplify the process of medical treatment on the basis of the hospital's existing services, reduce the waiting time for medical treatment, convenient for patients to seek...

cics-info NSE Script

Using the CICS transaction CEMT, this script attempts to gather information about the current CICS transaction server region. It gathers OS information, Datasets files, transactions and user ids. Based on CICSpwn script by Ayoub ELAASSAL. Script Arguments cics-info.trans Instead of gathering all...

tso-brute NSE Script

TSO account brute forcer. This script relies on the NSE TN3270 library which emulates a TN3270 screen for NMAP. TSO user IDs have the following rules: - it cannot begin with a number - only contains alpha-numeric characters and @, , $. - it cannot be longer than 7 chars Script Arguments...

TeamViewer 11.0.65452 (x64) - Local Credentials Disclosure

TeamViewer 11.0.65452 x64 - Local Credentials Disclosure TeamViewer 11.0.65452 64 bit Local Credentials Disclosure Tested on Windows 7 64bit, English Vendor Homepage @ https://www.teamviewer.com/ Date 07/09/2016 Bug Discovered by Alexander Korznikov https://www.linkedin.com/in/nopernik...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0008) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - A directory traversal vulnerability exists that allows a remote attacker to read arbitrary files. CVE-2011-0426 - An information disclosure vulnerability exists due to...

IBM WebSphere MQ File Transfer Edition Web Gateway CSRF Vulnerability

No description provided by source. Exploit Author: Nir Valtman Description: Malicious user is able to add userspace, change permissions on existing userspace and add MQMD MQ Message Descriptor user IDs. All of the these vulnerabilities can be exploited using a CSRF Cross Site Request Forgery...

Simplog <= 0.9.3.1 comments.php Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php ?php / Simplog 0.9.3.1 Remote SQL Injection Vulnerability Note: Requires at least one blog entry to be made prior to injection Usage: php script.php host path user id Usage Example: php script.php domain.com /simplog/ 1 Googledork: intext:Powered b...

CVE-2014-1664

The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file...

Authentication flaw

The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file...

CVE-2014-1664

The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file...

CVE-2014-1664

The CVE-2014-1664 entry concerns Citrix GoToMeeting for Android version 5.0.799.1238, which logs HTTP requests containing sensitive data. The underlying issue is information disclosure via logs read by other Android apps with system log access, enabling leakage of user IDs, meeting details, and a...

Apache suEXEC - Information Disclosure / Privilege Escalation

Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web server. Normally, when a CGI or SSI program executes, it runs as...

22 million Yahoo IDs stolen from their Japanese Server

22 million Yahoo! Japan's user IDs may have been stolen during an unauthorised attempt to access the administrative system of its Japan portal. “We don’t know if the file of 22 million user IDs was leaked or not, but we can't deny the possibility given the volume of traffic between our server and...

DEBIAN-CVE-2013-0273

sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service application crash via a crafted packet...

Anonymous users can see page restriction data, exposing user ids and group names

If an user navigates to a page that has any kind of individual "editing" restriction but is of public view and then clicks on the padlock icon, he or she will see the Names, Uids of the users who are mentioned in the "edit" restriction or any groups part if the restriction. We think it is wrong t...

Anonymous users can see page restriction data, exposing user ids and group names

If an user navigates to a page that has any kind of individual "editing" restriction but is of public view and then clicks on the padlock icon, he or she will see the Names, Uids of the users who are mentioned in the "edit" restriction or any groups part if the restriction. We think it is wrong t...

Anonymous users can see page restriction data, exposing user ids and group names

If an user navigates to a page that has any kind of individual "editing" restriction but is of public view and then clicks on the padlock icon, he or she will see the Names, Uids of the users who are mentioned in the "edit" restriction or any groups part if the restriction. We think it is wrong t...

Anonymous leaks database from Israeli Musical Act Magazine site #OpIsrael

This Morning Anonymous member with twitter handle @OsamaTheGod leaked a huge database from server of Israeli Musical Act Magazine act.co.il. The leaked database posted on public note website and includes users ID, username, password in clear text, IP address and phone numbers. Hacker posted data ...