15847 matches found
CVE-2021-44848
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...
CVE-2021-44848
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...
Authentication flaw
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...
CVE-2021-44848: Observable Discrepancy
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...
PT-2021-24052 · Reprise · Reprise Rlm
Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2 Description: An issue was discovered in the "/goform/login process" API endpoint in Reprise RLM. When an attacker attempts to login, the response if a username is valid includes "Login Failed", but does not include th...
The vulnerability of system applications in the HarmonyOS operating system, related to privilege management errors, allows a perpetrator to alter the user’s pseudonym.
The vulnerability of HarmonyOS’ system applications is related to privilege management errors. Exploiting this vulnerability allows a malicious actor to remotely change a user’s username...
Chikitsa Patient Management System 2.0.2 Plugin Remote Code Execution
Exploit Title: Chikitsa Patient Management System 2.0.2 - Remote Code Execution RCE Authenticated Date: 03/12/2021 Exploit Author: 0z09e https://twitter.com/0z09e Vendor Homepage: https://sourceforge.net/u/dharashah/profile/ Software Link:...
Reprise License Manager 14.2 User Enumeration
Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44155 Vulnerability Title: Unauthenticated User Enumeration Severity: Low Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Date: 2021-11-25...
CVE-2021-43175
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly,...
CVE-2021-43175
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly,...
CVE-2020-27413
An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application...
Default credentials
An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application...
CVE-2020-27413
The CVE-2020-27413 issue affects Mahavitaran Android app (version 7.50 and earlier). The underlying problem is how usernames and passwords are stored, enabling a local attacker to read cleartext credentials while the user is logged in. Multiple connected records (Red Hat, CNVD, CNNVD, CVE diag) c...
CVE-2020-27413: Insufficiently Protected Credentials
An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application...
The vulnerability of the username_filter parameter in the user_list.php script of the Advantech R-SeeNet monitoring software allows a hacker to disclose protected information.
The vulnerability of the usernamefilter parameter in the userlist.php script of the Advantech R-SeeNet monitoring software relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially...
Cross-site Request Forgery (CSRF)
ssddanbrown/bookstack is vulnerable to cross-site request forgery attacks. The library does not properly validate the user login flow after the email confirmation, allowing an attacker to duplicate the username and gain access to the account when user click the confirmation link...
PT-2021-7512
Name of the Vulnerable Software and Affected Versions reolink RLC-410W version 3.0.0.136 20121102 Description A command injection issue exists in the device network settings functionality due to improper validation of the ddns-username variable, which is set based on the userName parameter provid...
PT-2021-5095
Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description A specially-crafted HTTP request can lead to SQL injection, allowing an attacker to disclose protected information. This can be triggered through the username filter parameter with...
Bludit 3.13.1 - (username) Cross Site Scripting Vulnerability
Exploit Title: Bludit 3.13.1 - 'username' Cross Site Scripting XSS Exploit Author: Vasu tamilanmkv Vendor Homepage: https://www.bludit.com Software Link: https://www.bludit.com/releases/bludit-3-13-1.zip Version: bludit-3-13-1 Tested on: kali linux CVE : CVE-2021-35323 Steps to reproduce 1. Open...
EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-2751)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the...