CVE-2020-5143

SonicOS SSLVPN login page vulnerability CVE-2020-5143 allows remote unauthenticated username enumeration based on server responses. Affected: SonicOS Gen 5 (5.9.1.7, 5.9.1.13), Gen 6 (6.5.4.7, 6.5.1.12, 6.0.5.3), SonicOSv 6.5.4.v, Gen 7 (SonicOS 7.0.0.0). Root cause: username enumeration through ...

CVE-2020-5143

SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and G...

SonicOS SSLVPN login page administrator username enumeration vulnerability

SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, and SonicOSv 6.5.4.v...

CVE-2020-15646

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

Design/Logic Flaw

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid "Unable to find an APIDomain" versus "Wrong email or password"...

CVE-2020-26526

Technical details about CVE-2020-26526 are not publicly provided in the supplied documents. What is disclosed is the login-page username enumeration issue for Damstra Smart Asset 2020.7. Monitor for updates from vendors/security advisories.

CVE-2020-26524

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration...

CVE-2020-26524

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration...

Design/Logic Flaw

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration...

CVE-2020-26524

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration...

CVE-2020-26524

CodeLathe FileCloud prior to 20.2.0.11915 contains an information-disclosure vulnerability that allows username enumeration. Affected product: CodeLathe FileCloud. Impact: attacker can enumerate usernames, facilitating targeted access attempts. Root cause: insufficient input handling leading to u...

Malicious Package

loadyaml is a malicious package. The package exfiltrates IP, IP-based geolocation, home directory name, and local username through a preinstall script during installation...

Malicious Package

electorn is a malicious package. The package exfiltrates IP, IP-based geolocation, home directory name, and local username through a preinstall script during installation...

MedDream PACS Server 6.8.3.751 Remote Code Execution

!/usr/bin/python Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution Authenticated Exploit Author: bzyo Twitter: @bzyo Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution Authenticated Date: 2020-10-01 Vulnerable Software:...

MedDream PACS Server 6.8.3.751 - Remote Code Execution (Authenticated)

!/usr/bin/python Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution Authenticated Exploit Author: bzyo Twitter: @bzyo Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution Authenticated Date: 2020-10-01 Vulnerable Software:...

CVE-2020-25200

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames wil...

CVE-2020-25200

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames wil...