2625 matches found
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker...
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker...
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker...
CVE-2023-3897
Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...
PT-2023-26709 · 42Gears · Suremdm
Name of the Vulnerable Software and Affected Versions: SureMDM On-premise versions 6.31 and below Description: The issue allows for username enumeration through bypassing CAPTCHA in the On-premise SureMDM Solution on Windows deployment. This enables an attacker to enumerate local user information...
42Gears SureMDM 安全漏洞
42gears Mobility Systems 42Gears SureMDM is an asset management platform for mobile devices from 42gears Mobility Systems, USA. The platform is primarily used to monitor and manage enterprise mobile devices. A security vulnerability exists in 42gears Mobility Systems 42Gears SureMDM version 6.31...
GHSA-87F6-8GR7-PC6H KubePi may leak password hash of any user
Summary http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user including admin. This leads to password crack attack PoC https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview Impact - Leaking confidential information. - Can lead to password...
CVE-2023-3757 GZ Scripts Car Rental Script cross site scripting
A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/showheader=T/local=3. The manipulation of the argument...
LMS by Masteriyo < 1.6.8 - Information Exposure
The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. PoC curl -i -s -k -X $'GET' \ -H $'Host: localhost:8000' -H $'sec-ch-ua: ' -H $'Accept:...
CVE-2023-34106
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should...
Information Disclosure
flaskappbuilder is vulnerable to Information Disclosure. The vulnerability exists in the crud operator functions in interface.py due to log messages which are not properly sanitized during database errors, allowing an admin authenticated attacker to gain access to sensitive user information such ...
PT-2023-20551 · WordPress · Kivicare
Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue allows low-privilege users, such as subscribers, to retrieve sensitive information of other users, including email and hashed password, due to the lack of restriction on...
UBUNTU-CVE-2020-22402
Cross Site Scripting XSS vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code...
CVE-2023-34965
SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...
Information disclosure
SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...
CVE-2023-34965
SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...
SSPanel UIM 安全漏洞
SSPanel UIM is a multi-purpose proxy service sales management system designed for the Shadowsocks / V2Ray / Trojan protocols by the individual developer Anankke. A security vulnerability exists in SSPanel UIM version 2023.3, which stems from not restricting access to the interface, leading to the...
CVE-2023-34965
SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...
CVE-2023-34965
SSPanel-Uim 2023.3 contains an information-disclosure issue caused by improper authorization: the /link/ interface is not access-restricted, allowing potential leakage of user data. Multiple sources (NVD/NVD-derived entries and vendor/analyst databases) confirm that the vulnerability stems from n...