13871 matches found
CVE-2020-15392
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...
CVE-2020-15392
CVE-2020-15392 — A user enumeration vulnerability in Venki Supravizio BPM 10.1.2 is triggered during password recovery. The issue arises from differing error messages that let an attacker determine whether a username exists, enabling brute-force use of valid usernames. Connected documents corrobo...
CVE-2020-15392: Observable Discrepancy
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...
PT-2020-14405
Name of the Vulnerable Software and Affected Versions Venki Supravizio BPM version 10.1.2 Description A user enumeration flaw was found in the password recovery process. This issue allows an attacker to determine if a username is valid or not by analyzing the difference in error messages, enablin...
CVE-2020-15367: Improper Restriction of Excessive Authentication Attempts
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...
PT-2020-14395
Name of the Vulnerable Software and Affected Versions Venki Supravizio BPM version 10.1.2 Description The issue allows an unauthenticated user to launch a brute-force authentication attack against the Login page due to the lack of limitation on the number of authentication attempts. Recommendatio...
Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager
CVE-2020-5902 exploit code for F5-Big-IP CVE-2020-5902 S...
Engel & Völkers Technology GmbH: Improper authentication on phpmyadmin portal which is hosted in https://eventapp.engelvoelkers.com
Summary: Hi Team, following domain https://eventapp.engelvoelkers.com/ publicly exposed phpmyadmin portal and authentication mechanism is poorly configured, On response manipulation, application giving access to internal structure of phpmyadmin portal, which disclosing many internal paths and sta...
OpenClinic GA has an unspecified vulnerability
OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. A security vulnerability exists in OpenClinic GA version 5.09.02 and version 5.89.05b. An attacker can exploit this...
CVE-2020-3297
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...
Design/Logic Flaw
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...
CVE-2020-3297 Cisco Small Business Smart and Managed Switches Session Management Vulnerability
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...
CVE-2020-3297 Cisco Small Business Smart and Managed Switches Session Management Vulnerability
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...
F5 Networks BIG-IP : BIG-IP APM Edge Client vulnerability (K97733133)
When a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection. CVE-2020-5893 Impact An attacker can use a man-in-the-middle MITM attack by deploying a...
Cisco Small Business Smart and Managed Switches Session Management Vulnerability
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...
Exploit for Improper Restriction of Excessive Authentication Attempts in Venki Supravizio_Bpm
CVE-2020-15367 Brute Force on Supravizio BPM 10.1.2...
Clario: No rate Limit on Licenses Activation
Introduction A little bit about Rate Limit A rate-limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time-frame, HTTP-Servers can respond with status code 429...
The vulnerability of the SharePort Web Access component of the D-Link DIR-865L router’s microprogramming software allows a hacker to circumvent existing security restrictions through brute-force attacks.
The vulnerability of the SharePort Web Access component of the D-Link DIR-865L router software relates to insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions through brute-force attacks...
Self-Propagating Lucifer Malware Targets Windows Systems
Security experts have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service DDoS attacks. The never-before-seen malware initially tries to infect PCs by bombarding them with exploits in hopes of taking advantage of...
Cross site request forgery (csrf)
An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the directory /private/sessions. An unauthenticated user could use a brute-force approach to attempt to identify existing sessions, or view the...