16297 matches found
CVE-2022-32741
The CVE-2022-32741 entry concerns OTRS (versions 7.x up to 7.0.35 and 8.x up to 8.0.23) where the Request New Password feature can leak valid usernames via response-time differences, enabling user enumeration. The root cause is timing-based information disclosure in the password-reset flow. The p...
CVE-2022-32741 Information disclosure in Request New Password feature
Attacker is able to determine if the provided username exists and it's valid using Request New Password feature, based on the response time...
CVE-2022-32741
Attacker is able to determine if the provided username exists and it's valid using Request New Password feature, based on the response time...
OTRS security vulnerabilities
OTRS is an application from the German company OTRS. A service management software. A security vulnerability exists in OTRS versions 8.0.x through 8.0.23 and OTRS versions 7.0.x through 7.0.35, which stems from a difference in application response times. An attacker could exploit the vulnerabilit...
CVE-2022-23168: Improper Neutralization of Special Elements used in an SQL Command
The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--...
PT-2022-15894
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows an attacker to gain access to the database. It is caused by a SQL injection vulnerability in the username parameter at the login panel. The attack can be performed by...
Design/Logic Flaw
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration e.g., username and password...
PT-2022-8038
Name of the Vulnerable Software and Affected Versions Netwave IP camera devices affected versions not specified Description The issue allows an unauthenticated attacker to exfiltrate sensitive information, such as username and password, from the network configuration of Netwave IP camera devices...
CVE-2022-30898
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
Cross site request forgery (csrf)
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
CVE-2022-30898
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
CVE-2022-23168
The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--...
PT-2022-20366
Name of the Vulnerable Software and Affected Versions Cscms music portal system version 4.2 Description A Cross-site request forgery CSRF issue allows remote attackers to change the administrator's username and password. This can be exploited by tricking the administrator into performing unintend...
GLPI cross-site scripting vulnerabilities
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
CVE-2022-30898: Cross-Site Request Forgery (CSRF)
A Cross-site request forgery CSRF vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password...
TOTOLINK EX1200T Trust Management Issue Vulnerability
TOTOLINK EX1200T is a Wi-Fi range extender from China-based Gion Electronics TOTOLINK.TOTOLINK EX1200T is vulnerable to a trust management issue, which stems from the presence of a default username and password in the firmware, and can be exploited by an attacker to launch telnet without...
CVE-2021-3754
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password. Mitigation The workaround is to enable "Email as username" flag ...
PT-2022-5054
Name of the Vulnerable Software and Affected Versions SuiteCRM affected versions not specified Description The issue is related to inadequate access control in the SuiteCRM customer relationship management system. Exploitation of this issue could allow a remote attacker to gain unauthorized acces...