August 11, 2020—KB4571692 (OS Build 10240.18666)

None None...

Sulu Information Disclosure Vulnerability

Sulu is an extensible, PHP-based open source content management system on the Symfony framework from Sulu Austria. A security vulnerability exists in Sulu versions prior to 1.6.35, prior to 2.0.10, and prior to 2.1.1. An attacker can exploit the vulnerability to retrieve valid usernames as well a...

CVE-2020-15132

Sulu CMS vulnerability CVE-2020-15132 affects Sulu versions prior to 1.6.35, 2.0.10, and 2.1.1. The Forget Password flow reveals whether a username exists by returning a 400 with a message when the user is not found, enabling user enumeration. Additionally, a successful Forgot Password request re...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

Design/Logic Flaw

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-8213

An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing...

CVE-2020-8213

An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

GSA Bounty: Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.gov

Summary: Hello TTS Bug bounty team! I have found data.gov User/admin usernames disclosed. Using REST API, we can see all the WordPress users/author with some of their information. Steps To Reproduce: You can find the information disclosure by going to data.gov/wp-json/wp/v2/users/ Supporting Vide...

CVE-2020-11625

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate wheth...

GHSA-V7M9-9497-P9GR Possible pod name collisions in jupyterhub-kubespawner

Impact What kind of vulnerability is it? Who is impacted? JupyterHub deployments using: - KubeSpawner = 0.11.1 e.g. zero-to-jupyterhub 0.9.0 and - enabled namedservers not default, and - an Authenticator that allows: - usernames with hyphens or other characters that require escape e.g. user-hyphe...

Authorization Bypass

jupyterhubkubespawner is vulnerable to authorization bypass. An attacker is able to submit specific usernames which will grant access to the default server of the other users that uses the same username...

CVE-2020-15110

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12...

PYSEC-2020-51

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12...

CVE-2020-15110 Possible pod name collisions in jupyterhub-kubespawner

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12...

Kasa camera flaw allows enumerating usernames for credential stuffing

By Sudais Asif The hacker who happens to be a hobbyist farmer and Kasa camera... This is a post from HackRead.com Read the original post: Kasa camera flaw allows enumerating usernames for credential stuffing...

Information Disclosure

npm is vulnerable to information disclosure. The URL in the format ://:@::/ is supported and the password is not redacted when printed to stdout or log files. This allows a user with access to the system to retrieve the usernames and passwords...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-13776

A flaw was found in systemd, where it mishandles numerical usernames beginning with decimal digits, or "0x" followed by hexadecimal digits. When the usernames are used by systemd, for example in service units, an unexpected user may be used instead. In some particular configurations, this flaw...