12604 matches found
CVE-2022-23342
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login...
Design/Logic Flaw
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login...
CVE-2022-23342
CVE-2022-23342 affects Hyland OnBase Application Server and OnBase releases prior to 20.3.58.1000 and 21.1.1.1000–21.1.15.1000. The issue is a username enumeration vulnerability: an attacker can determine valid usernames by inspecting responses to POST requests to the endpoint /mobilebroker/Servi...
CVE-2017-20057
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting Persistent. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to addres...
PT-2022-20637 · Suse · Suse Manager Server +1
Name of the Vulnerable Software and Affected Versions: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1 SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1 Description: A Observable Response Discrepancy issue in spacewalk-java of SUSE Manager Server allows remote...
CVE-2022-31248
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java...
Username can be enumerated by password reset endpoint
Description The error message on /password/reset/1 can indicate whether the username exists in the instance. I believe this is a valid issue for the following reason: 1. /password/reset after submitting the username on this page, the server always returns success no matter whether the username...
CVE-2022-30328
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface...
CVE-2022-30328
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface...
CVE-2021-41487
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...
CVE-2021-41487
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...
CVE-2021-41487
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...
Sql injection
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...
CVE-2021-41487
CVE-2021-41487 affects Nokia VitalSuite SPM 2020. The vulnerability is an SQL injection in the UserName parameter, caused by improper input handling that allows an attacker to inject SQL commands. In the sources, exploitation is described as remote and capable of affecting confidentiality, integr...
CVE-2021-41487
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'...
NOKIA VitalSuite SPM SQL注入漏洞
NOKIA VitalSuite SPM is a multi-vendor, multi-application performance management solution from Nokia Finland. A security vulnerability exists in NOKIA VitalSuite SPM version 2020. An attacker exploited the vulnerability to perform SQL injection via UserName...
Cross-site Scripting (XSS)
facturascripts/facturascripts is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization of the username field allowing an attacker to input maliciously crafted script via the username field when showing 'login-user-not-found' message...
Employee Leaves Management System 跨站请求伪造漏洞
Employee Leaves Management System ELMS is an internal employee management system. A cross-site request forgery vulnerability exists in Employee Leaves Management System ELMS v2.1, which can be exploited by an attacker to change the details of any user profile, such as username, phone number, etc...
CVE-2022-33174
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...