42 matches found
CVE-2022-26913 Windows Authentication Information Disclosure Vulnerability
...
Thirdparty site authorization header leak
Description mechanize library is used to manipulate the URL of web pages and crawl the contents of web pages. mechanize does not filter the request header after redirecting. It will also transfer the authentication and cookie request header of the first request to the service after redirecting,...
Mageia: Security Advisory (MGASA-2015-0282)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-8339
A cross-site scripting inclusion XSSI vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module AMM web interface prior to version 3.68n BPET68N. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a...
Unspecified Vulnerability in Juniper Networks Junos OS (CNVD-2019-41470)
Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS, which is caused by a program that records authentication...
Rakuma App vulnerable to authentication information disclosure
Overview Rakuma App provided by Rakuten, Inc. contains an authentication information disclosure vulnerability CWE-200. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
Debian: Security Advisory (DSA-4441-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: Offline dictionary attack vulnerability in IBM Spectrum Protect (formerly Tivoli Storage Manager) (CVE-2016-8937)
Summary IBM Spectrum Protect formerly Tivoli Storage Manager is vulnerable to an offline dictionary attack due to information disclosed during authentication. An attacker can gain full access to the IBM Spectrum Protect system allowing them to perform operations they may not be authorized to...
Haxx libcurl HTTP Authentication Disclosure Vulnerability
Haxx libcurl is a free , open source client-side URL transport library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. A security vulnerability exists in Haxx libcurl versions 7.1 through 7.57.0. An attacker can exploit the vulnerability to obtain sensitive...
MySQL 5.6.x < 5.6.36 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU) (Riddle)
The version of MySQL running on the remote host is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the mysqlprunestmtlist function in client.c that allows an authenticated, remote attacker to cause a denial of service condition...
MySQL 5.5.x < 5.5.55 Multiple Vulnerabilities (April 2017 CPU) (Riddle)
The version of MySQL running on the remote host is 5.5.x prior to 5.5.55. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the mysqlprunestmtlist function in client.c that allows an authenticated, remote attacker to cause a denial of service condition...
MySQL 5.5.x < 5.5.55 Multiple Vulnerabilities (April 2017 CPU) (Riddle)
The version of MySQL running on the remote host is 5.5.x prior to 5.5.55. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the mysqlprunestmtlist function in client.c that allows an authenticated, remote attacker to cause a denial of service condition...
Microsoft IIS 4.0/5.0/5.1 Authentication Method Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4235/info Microsoft IIS supports Basic and NTLM authentication. Reportedly, the authentication methods supported by a given IIS server can be revealed to an attacker through the inspection of returned error messages, even...
NinkoBB 1.3RC5 XSS Vulnerability
No description provided by source. Vulnerability ID: HTB22652 Reference: http://www.htbridge.ch/advisory/xssinninkobb.html Product: NinkoBB Vendor: NinkoBB http://ninkobb.com Vulnerable Version: 1.3RC5 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability Type: XSS Cross...
Citrix NetScaler Application Delivery Controller Multiple Vulnerabilities
The remote Citrix NetScaler version is affected by multiple vulnerabilities : - A denial of service vulnerability in the VM Virtual Machine Daemon. Please note that this particular vulnerability does not apply to Citrix NetScaler 10.1. CVE-2013-6938 - A denial of service vulnerability in the...
ManageEngine DeviceExpert 5.6 Java Server Directory Traversal
Exploit for jsp platform in category web applications ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Database Backup / auth-conf.xml Disclosure Exploit product homepage: http://www.manageengine.com/products/device-expert/ file...
Direct access to issue via url discloses structure without authentication
If an issue is accessed via the direct url an error message discloses if the issue is existent or not - even when the use isn't logged-in. In contrast, an existing issue redirects to the login form. This knowledge may open an attack vector on private Jira instances that require authentication...
CodeAvalanche News 1.2 - default.asp SQL Injection
CodeAvalanche News 1.2 - default.asp SQL Injection source: https://www.securityfocus.com/bid/18031/info CodeAvalanche News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...
PT-2005-1543 · Rsa +1 · Rsa Securid +2
Name of the Vulnerable Software and Affected Versions: Tarantella Secure Global Desktop Enterprise Edition versions 3.42 through 4.00 Tarantella Enterprise 3 versions 3.30 through 3.40 Description: The issue reveals sensitive information during authentication when multiple users have the same...
Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration
Title: Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration. Software: News Manager Lite 2.5 & News Manager Lite administration. Vendor: http://www.expinion.net/software/appnewsmanager.asp Impact: Disclosure of authentication information, Disclosure of user information,...