12642 matches found
Nextcloud: Username and Access Token Disclousure
Versions ===================== Nextcloud Server Version: 16.0.3.0 it.tsweb.Nextcloud iOS App Version: 2.23.7 Description ===================== While logging in to an owncloud instance the iOS client sends the Username and password to the ressource /login?redirecturl=/login/flow/grant and recieves...
CVE-2019-8448
The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability...
CVE-2019-8448
CVE-2019-8448 affects Atlassian Jira Server: the login.jsp component in Jira versions prior to 7.13.4 and 8.0.x prior to 8.2.2 is exploitable via insufficient validation, allowing an unauthenticated remote attacker to enumerate usernames. This is an information-disclosure vulnerability. The cited...
ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Application Manager v14.2 - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and comman...
ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution Exploit
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager v12.4x - Unauthenticated Remote Command Execution", 'Description' = %q This module bypasses the user password requirement i...
cPanel Input Validation Error Vulnerability (CNVD-2019-29604)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 68.0.15, which stems from the program allowing user accounts to be...
CVE-2017-18465
cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...
CVE-2017-18465
cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...
GSA Bounty: Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov
Hi Team, I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username on data.gov x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33184/mtime:1513269652/atime:1513269652/md5:2049644b6b833f5dbb826f60a4721f64/ctime:1513269652 Server:...
CVE-2017-18393
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...
CVE-2017-18393
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
CVE-2017-18395
cPanel before 68.0.15 does not block a username of ssl SEC-328...
Design/Logic Flaw
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
Design/Logic Flaw
cPanel before 68.0.15 does not block a username of ssl SEC-328...
CVE-2017-18401
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...
CVE-2017-18401
CVE-2017-18401 affects cPanel prior to 68.0.15, where account creation could partially succeed with invalid username formats (SEC-334). The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD). A patch to 68.0.15 or later is the stated remediation in available references; no exp...
CVE-2017-18395
cPanel before 68.0.15 does not block a username of ssl SEC-328...
CVE-2017-18395
CVE-2017-18395 affects cPanel before 68.0.15, where the system does not block a username of ssl (SEC-328). This is corroborated by Red Hat and other records in the connected data. Public details describe the issue but do not provide a patch or remediation steps within the supplied documents. CVSS...