12642 matches found
CVE-2020-13321
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added...
CVE-2020-13321
CVE-2020-13321 affects GitLab versions prior to 13.1 where username format restrictions can be bypassed, allowing HTML tags to be added. This is caused by insufficient validation of usernames, per multiple connected sources. Impact is partial confidentiality/integrity exposure as per CVSS metrics...
WebsiteBaker 2.12.2 - Remote Code Execution
Exploit Title: WebsiteBaker 2.12.2 - Remote Code Execution Date: 2020-07-04 Exploit Author: Selim Enes 'Enesdex' Karaduman Vendor Homepage: https://websitebaker.org/pages/en/home.php Software Link: https://wiki.websitebaker.org/doku.php/downloads Version: 2.12.2 Tested on: Windows 10 and Ubuntu...
PT-2020-13462 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1 Description: A vulnerability was discovered that allows username format restrictions to be bypassed, enabling the addition of html tags. Recommendations: For versions prior to 13.1, update to version 13.1 or late...
Observium SQL Injection Vulnerability
Observium is a low-maintenance auto-discovery network monitoring platform that supports multiple device types, platforms and operating systems. Observium suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to inject malicious SQL statements via username0 of the...
CVE-2020-25147
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username0 to the default URI, because of...
The ugidd RPC interface by design allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.
...
Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability
Talos Vulnerability Report TALOS-2020-1097 Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability September 23, 2020 CVE Number CVE-2020-6153 Summary An exploitable SQL injection vulnerability exists in the FavoritesService.asmx Web Service functionality of eDNA...
IBM Data Risk Manager Information Disclosure Vulnerability
IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. An information disclosure vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit this vulnerability to obtain sensitive username information via a...
CVE-2020-4616
IBM Data Risk Manager iDNA 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929...
Denial Of Service (DoS)
firefox is vulnerable to denial of service DoS. The vulnerability exists when a long user name is used in a username/password combination in a site URL, such as http://UserName:[email protected]", causing the resulting modal prompt to be in a non-responsive state or crash...
Heybbs SQL Injection Vulnerability
HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A SQL injection vulnerability exists in the login.php file of Heybbs version 1.2. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of...
This One Time on a Pen Test: Outwitting the Vexing VPN
Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. Just...
CVE-2020-13289
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated...
PT-2020-13430 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered in certain cases where an invalid username could be accepted when 2FA is activated. Recommendations:...
Exposure of Sensitive Information to an Unauthorized Actor in traduora/traduora
Description Username Enumeration in traduora. Proof of Concept 1. setup traduora to reproduce the vulnerability 2. go to sign in page http://localhost:8080/login 3. Append non registered user email and password it shows Error,resource not found 4. when Appending correct username and fake password...
CVE-2020-24197
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter...
CVE-2020-24197
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter...
Siemens Spectrum Power™ 4 Unsecure Storage of Sensitive Information Vulnerability
Spectrum Power™4 provides the basic components for modeling data for SCADA, communications, and control and monitoring systems. A security vulnerability exists in Siemens Spectrum Power™4. An attacker could exploit the vulnerability to cause the retrieval of a username...