12610 matches found
ServiceNow - Username Enumeration Exploit
Exploit Title: ServiceNow - Username Enumeration Exploit Author: Victor Hanna Trustwave SpiderLabs Author Github Page: https://9lyph.github.io/CVE-2021-45901/ Vendor Homepage: https://www.servicenow.com/ Software Link:...
CVE-2021-43049 TIBCO BusinessConnect Container Edition username and password leakage
The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO...
CVE-2021-46558
Multiple cross-site scripting XSS vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields...
CVE-2021-46558
Multiple cross-site scripting XSS vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields...
CVE-2021-46558
Multiple cross-site scripting XSS vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields...
H3C SSL VPN Username Enumeration Vulnerability
H3C SSL VPN Username Enumeration Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd. Product web page: https://www.h3c.com Affected version: n/a Summary: H3C SSL VPN is a secure VPN system based on SSL connections. It allows mobile employees to access corporate networks remotel...
Exploit for Incorrect Authorization in Polkit_Project Polkit
CVE-2021-3560-Polkit-DBus Simple proof of concenpt script for...
GHSA-VH5C-JQFG-MHRH Cross-Site Request Forgery in xwiki-platform
Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which usernames is actually tight to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists...
IBM Guardium Data Encryption Information Disclosure Vulnerability (CNVD-2022-08967)
IBM Guardium Data Encryption GDE is an application from IBM USA, Inc. IBM Guardium Data Encryption GDE 5.0.0.2 contains a security vulnerability that can be exploited by attackers to cause username enumeration...
PrinterLogic Web Stack Insecure Direct Object Reference (IDOR) Vulnerability
PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic USA, Inc. Enabling the It department to manage and automate the creation/propagation of PrinterObjects and printer drivers across print environments from a single management console. PrinterLogic W...
Mitsubishi Electric SmartRTU Cross-site Scripting (CVE-2018-16061)
Mitsubishi Electric SmartRTU devices allow XSS via the username parameter or PATHINFO to login.php. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
CVE-2022-24551
A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any local user password including system/administrator user using any available user This affects StarWind SAN and NAS v0.2 build 1633...
Servisnet Tessa - Privilege Escalation Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Servisnet Tessa - Privilege Escalation Metasploit', 'Description' = %q This module exploits privilege escalation in Servisnet Tessa, triggered by...
CVE-2021-39021
IBM Guardium Data Encryption (GDE) 5.0.0.2 (Guardium Data Encryption Server 5.0.0.2 / CipherTrust Manager 2.4.2) exhibits behavior where responses differ under certain conditions in a way observable to an unauthenticated actor, enabling username enumeration. The issue is confirmed in multiple sou...
CVE-2021-39021
IBM Guardium Data Encryption GDE 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which could facilitate username enumeration. IBM X-Force ID: 213856...
CVE-2021-32732 Cross-Site Request Forgery in xwiki-platform
Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which usernames is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those...
CVE-2021-39021
IBM Guardium Data Encryption GDE 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which could facilitate username enumeration. IBM X-Force ID: 213856...