2113 matches found
CVE-2020-6178
SAP Enable Now (before version 1911) is affected by CVE-2020-6178, where the Session ID cookie value is sent in the URL. This creates a risk of information disclosure if the URL is captured from browser history or logs. The description is consistently stated across multiple sources (NVD entry and...
CVE-2020-1872
Huawei smart phones P10 Plus with versions earlier than 9.1.0.201C01E75R1P12T8, earlier than 9.1.0.252C185E2R1P9T8, earlier than 9.1.0.252C432E4R1P9T8, and earlier than 9.1.0.255C576E6R1P8T8 have a digital balance bypass vulnerability. When re-configuring the mobile phone at the digital balance...
SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2020:0331-1)
This update for systemd fixes the following issues : CVE-2020-1712 bscbsc1162108 Fix a heap use-after-free vulnerability, when asynchronous Polkit queries were performed while handling Dbus messages. A local unprivileged attacker could have abused this flaw to crash systemd services or potentiall...
The vulnerability of the XML platform’s syntactic analyzer, which is designed to enhance the effectiveness of educational materials and documentation. SAP Enable Now allows unauthorized access to protected information.
The vulnerability of the XML syntax analyzer on the SAP Enable Now platform, which is designed to improve the effectiveness of educational materials and documentation, is related to errors in XML link restrictions. Exploiting this vulnerability could allow an attacker to gain unauthorized access ...
The vulnerability of the SAP Enable Now platform stems from deficiencies in the encryption of user-input data, allowing attackers to carry out XSS attacks.
The vulnerability of the SAP Enable Now platform exists due to deficiencies in the encryption of user-input data. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...
The vulnerability of the SAP Enable Now platform, which is related to insufficient validation of input data, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the SAP Enable Now platform, which is designed to ensure the effectiveness of educational materials and documentation, relates to insufficient validation of input data during cookie session implementation. Exploiting this vulnerability could allow an attacker operating remote...
CVE-2020-7210
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...
WAFW00F v2.0 - Allows One To Identify And Fingerprint Web Application Firewall (WAF) Products Protecting A Website
The Web Application FirewallFingerprinting Tool. — FromEnable Security How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...
Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode
There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. PoC Login as a user with subscriber or above permissions and send the following request to enable...
WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - Insecure Permissions: Enable and Disable Maintenance Mode vulnerability
Insecure Permissions: Enable and Disable Maintenance Mode vulnerability discovered by WordFence in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...
Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode
There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. Login as a user with subscriber or above permissions and send the following request to enable maintenance...
AVE DOMINAplus 1.10.x Cross Site Request Forgery / Cross Site Scripting
AVE DOMINAplus =1.10.x CSRF/XSS Vulnerabilities Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 - 1.10.3...
CVE-2019-19977
libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlmbuildtype2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read...
WP Accessibility < 1.7.0 - Minor Authenticated Stored XSS in custom CSS
A minor authenticated stored XSS vulnerability was found in the "Styles for Skiplinks when they have focus" section of the WP Accessibility plugin. 1 Navigate to the Settings page of the plugin https://example.com/wp-admin/options-general.php?page=wp-accessibility/wp-accessibility.php 2 Select th...
CVE-2019-18615
In CloudVision Portal CVP for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. This only affects CVP environments where: 1. Devices have enable mode passwords which a...
SAP Enable Now Input Validation Error Vulnerability (CNVD-2020-09648)
SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. SAP Enable Now Input Validation Error Vulnerability. An attacker could use this vulnerability to enter commands in...
SAP Enable Now Information Disclosure Vulnerability (CNVD-2020-09646)
SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. An information disclosure vulnerability exists in SAP Enable Now. An attacker could exploit this vulnerability to...
SAP Enable Now Information Disclosure Vulnerability
SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. An information disclosure vulnerability exists in SAP Enable Now. An attacker could use this vulnerability to obta...
CVE-2019-0405
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...
