Exploit for Missing Authentication for Critical Function in Atlassian Jira

CVE-2019-8449 CVE-2019-8449 Exploit for Jira Releases Below v8...

Jira 8.3.4 Information Disclosure

Exploit Title: Jira 8.3.4 - Information Disclosure Username Enumeration Date: 2019-09-11 Exploit Author: Mufeed VH Vendor Homepage: https://www.atlassian.com/ Software Link: https://www.atlassian.com/software/jira Version: 8.3.4 Tested on: Pop!OS 19.10 CVE : CVE-2019-8449 CVE-2019-8449 Exploit fo...

Authentication flaw

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...

GHSA-H362-M8F2-5X7C Password Hashing: Do not use MD5

Impact User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problemati...

CVE-2020-5222 Hard-Coded Key Used For Remember-me Token in OpenCast

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...

Cross site scripting

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

CVE-2020-8421

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

CVE-2020-8421

CVE-2020-8421 affects Joomla! core prior to 3.9.15, specifically the com_actionlogs component. The issue is described as inadequate escaping of usernames, which enables cross-site scripting (XSS) attacks. The vulnerability is present in Joomla! 3.x up to version 3.9.14, with a fix introduced in 3...

CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

PT-2020-20126 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.15 Description: An issue was discovered that allows XSS attacks due to inadequate escaping of usernames in com actionlogs. Recommendations: For versions prior to 3.9.15, update to version 3.9.15 or later to resol...

pkg -- vulnerability in libfetch

A programming error allows an attacker who can specify a URL with a username and/or password components to overflow libfetch3 buffers...

CVE-2020-8090

CVE-2020-8090: A1 WLAN Box ADB VV2220v2 devices are affected in the Storage Service’s Username field, where stored XSS can occur after a successful Administrator login. The issue is described as a stored cross-site scripting vulnerability impacting the Username field within the Storage Service se...

CVE-2014-3979

Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the IP...

CVE-2014-3979

Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the IP...

CVE-2020-7990

Adive Framework 2.0.8 has admin/user/add userName XSS...

CVE-2020-7990

Adive Framework 2.0.8 has admin/user/add userName XSS...

CVE-2019-12629 Cisco SD-WAN vManage Command Injection Vulnerability

A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in t...

CVE-2020-7245

Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's...

CVE-2020-7245

Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's...

Input validation

Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's...