12616 matches found
AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
Exploit Title: AbsoluteTelnet 11.24 - 'Username' Denial of Service PoC Discovered by: Yehia Elghaly Discovered Date: 2021-11-10 Vendor Homepage: https://www.celestialsoftware.net/ Software Link: https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe Tested Version: 11.24 Vulnerabilit...
Apache Traffic Control 注入漏洞
Apache Traffic Control is a distributed and scalable content distribution solution from the Apache Foundation. An LDAP injection vulnerability exists in Apache Traffic Control, which stems from the fact that a user can send a request with a crafted username to any API version of the POST/login...
The vulnerability of the web interface for remote administration of the IPMI corporate network switch UserGate D500 allows a hacker to obtain the current value of the user’s username (account information).
The vulnerability of the UserGate D500 enterprise network interface relates to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain the current user name account information by using the password reset form...
Time based username enumeration
Back in the day, it used to be easy to enumerate email addresses from forgotten password forms. Differences in the response made it easy to check if accounts existed. After that, you could brute force the password if there weren’t lockouts in place, or if there were, you could lockout a lot of us...
CVE-2021-40261
Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...
CVE-2021-24647
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or userna...
Information disclosure
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or...
CVE-2021-24647 Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or userna...
CVE-2021-42077
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...
CVE-2021-31600
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...
CVE-2021-42077
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...
CVE-2021-31600
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...
CVE-2021-42077
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/usermanager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be...
CVE-2021-31600
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user regardless of privileges can list all...
Sourcecodester Customer Relationship Management System SQL Injection Vulnerability
Sourcecodester Customer Relationship Management System is an open source Php project. Sourcecodester Customer Relationship Management System CRM is vulnerable to SQL injection in v1.0, which can be exploited by attackers via the username field in "customer/login .php" in the username field to...
Hitachi Vantara Pentaho 访问控制错误漏洞
Hitachi Vantara Pentaho, a service used by Hitachi Japan to store and manage data in big data environments, is vulnerable to an access control error that could be exploited to list all application usernames present in the Jackrabbit repository...
CVE-2021-39914
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user...
Denial of service
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user...
CVE-2021-39914
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user...
