Improper Authentication in Flask-AppBuilder

Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints...

PT-2022-11302 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: An authentication bypass risk was identified due to a type juggling vulnerability in the external database authentication functionality. Recommendations: At the moment, there is no...

Moodle 授权问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an authorization issue vulnerability that stems from a type juggling issue in the external database authentication...

CVE-2021-29621

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2021-29621

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

PYSEC-2021-90

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2021-29621 Observable Response Discrepancy in Flask-AppBuilder

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2021-29621

Removed by vendor...

CVE-2021-29621: Observable Discrepancy

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

Observable Response Discrepancy in Flask-AppBuilder

Impact User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Patches Upgrade to 3.3.0 For more information If you have any questions or commen...

Observable Response Discrepancy in Flask-AppBuilder

User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in...

CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

CVE-2017-1000356

Summary of sources: CVE‑2017‑1000356 affects Jenkins 2.56 and earlier (and 2.46.1 LTS and earlier) with CSRF vulnerabilities in the Jenkins user database authentication realm that could enable an attacker to create accounts or disrupt admin users, potentially enabling broader impacts. Connected a...

CVE-2017-1000356: Cross-Site Request Forgery (CSRF)

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in th...

CVE-2015-7224

puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysqluser' user parameter contains a host with a netmask...

A Managed Password Cracking Tool: GoCrack

FireEye’s Innovation and Custom Engineering ICE team released a tool called GoCrack that allows red teams to efficiently manage password cracking tasks across multiple GPU servers by providing an easy-to-use, web-based real-time UI to create, view, and manage tasks. Simply deploy a GoCrack server...

Database Authentication Failure(s) for Provided Credentials

Nessus was unable to log into one or more detected database systems for which credentials have been provided in order to perform authenticated checks. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid91822; scriptversion"$Revision: 1.2 $"; scriptcvsdate"$Date: 2017/12/...

Oracle-Database-Authentication

Oracle Database is prone to a remote security-bypass vulnerability that affects the authentication protocol. An attacker can exploit this issue to bypass the authentication process and gain unauthorized access to the database. This vulnerability affects Oracle Database 11g Release 1 and 11g Relea...

CVE-2014-8749

CVE-2014-8749 concerns a Server-Side Request Forgery (SSRF) in the BulletProof Security WordPress plugin, affecting admin/htaccess/bpsunlock.php. The vulnerability allows an attacker to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. Affected product/v...

DWebPro 3.4.1 Http.ini Plaintext Password Storage Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8438/info A vulnerability has been reported to exist in the DWebPro web server software. This problem allows an attacker to view database authentication credentials by accessing a plain text file named 'http.ini'. An...