CVE-2018-19654

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a...

Design/Logic Flaw

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a...

CVE-2016-9499: Observable Response Discrepancy

Accellion FTP server prior to version FTA912220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them...

CVE-2018-5165: Undefined Security Weakness

In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to...

CVE-2018-11554

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

Default credentials

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

CVE-2018-11554: Exposure of Sensitive Information to an Unauthorized Actor

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

PT-2018-10662

Name of the Vulnerable Software and Affected Versions YzmCMS versions 3.2 through 3.7 Description The issue concerns the forgotten-password feature in the index.php/member/reset/reset email.html file, which has a Response Discrepancy Information Exposure problem. Additionally, the verification co...

CVE-2016-10535: Observable Timing Discrepancy

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks

Overview CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as "Variant 3a" and "Variant 4". Description Speculative execution is a technique used by many modern processors to improve performance by...

CVE-2018-10949: Observable Discrepancy

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...

License count is incorrect on XMS console

We see consumed licenses on XMS console under Licensing tab is more while the total number of enrolled devices is less pulled a report from XM. The license file has been re-read on the licensing server and there is no change...

Design/Logic Flaw

In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist...

CVE-2014-9951

In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist...

CVE-2014-9951: Exposure of Sensitive Information to an Unauthorized Actor

In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist...

PT-2017-6414

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description An Information Exposure Through Timing Discrepancy issue could potentially exist in TrustZone in all Android releases from CAF using the Linux kernel. Recommendations At the moment, there is ...

Harvest: Client can redirect payment, causing payment discrepancy between Harvest and PayPal

Vulnerability details When a client views an invoice through the web interface, it'll show a "Pay with PayPal" button when a standard PayPal integration has been enabled. Clicking this button will submit a POST request to PayPal. This request contains a business parameter, which is the receiver o...

CVE-2016-9129

Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such...

CVE-2016-9129

CVE-2016-9129 affects Revive Adserver before 3.2.3. The issue is an information disclosure vulnerability where an attacker can determine whether an email address is associated with one or more user accounts by inspecting the password recovery message. This leaks partial confidentiality but cannot...

CVE-2016-9129

Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such...