CVE-2024-45823

Rockwell Automation FactoryTalk Batch View is affected by CVE-2024-45823, an authentication bypass due to shared secrets across accounts that could let a remote attacker impersonate a user after enumerating necessary info. Nessus notes Batch View

Cisco SSL VPN Bruteforce Login Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco SSL VPN Bruteforce Login Utility', 'Description' = % This module scans for Cisco SSL VPN web login portals and performs login brute force t...

WordPress ChopSlider3 Id SQL Injection Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress ChopSlider3 id SQLi Scanner', 'Description' = %q The iDangero.us Chop Slider 3 WordPress plugin version 3.4 and prior contains a blind...

HP Operations Manager Perfd Environment Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP Operations Manager Perfd Environment Scanner', 'Description' = %q This module will enumerate the process list of a remote machine by abusing H...

CVE-2024-41737

SAP CRM ABAP Insights Management allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application...

SAP CRM 代码问题漏洞

SAP CRM is a customer relationship management system from SAP in Germany. SAP CRM suffers from an information disclosure vulnerability that stems from the application's inadequate protection of sensitive information, which can be exploited by an authenticated attacker to enumerate accessible HTTP...

CVE-2024-6139

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in...

MAL-2024-5254 Malicious code in iam-enumerate (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in iam-enumerate (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Argo-cd authenticated users can enumerate clusters by name

Impact It’s possible for authenticated users to enumerate clusters by name by inspecting error messages: $ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H "Authorization: Bearer $token" "error":"permission denied: clusters, get, , sub: alice, iat:...

PT-2024-29792

Name of the Vulnerable Software and Affected Versions BeyondInsight versions prior to 23.1 Description An information disclosure issue exists, allowing an attacker to enumerate usernames. Recommendations For versions prior to 23.1, update to version 23.1 or later to resolve the issue...

CVE-2023-27283

IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545...

CVE-2024-29028

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

CVE-2024-29028

The CVE-2024-29028 entry concerns the memos service (GitHub project usememos/memos). It documents a Server-Side Request Forgery (SSRF) vulnerability in the API endpoint /o/get/httpmeta in version 0.13.2, allowing unauthenticated users to enumerate the internal network and read limited HTML values...

CVE-2023-6949

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of...

CVE-2023-6949

CVE-2023-6949 affects the HTTP service on DJI Mavic Mini 3 Pro. A Missing Authentication for Critical Function vulnerability on port 80 allows an attacker to enumerate and download videos and pictures stored in drone memory without authentication. Connected sources corroborate the issue and ident...

CVE-2023-6949

A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of...

BIT-MEDIAWIKI-2021-31552

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account and not...

BIT-MOODLE-2023-28334 Moodle: users' name enumeration possible via idor on learning plans page

Authenticated users were able to enumerate other users' names via the learning plans page...

CVE-2024-21501

An information exposure flaw was found in the sanitize-html package, when used on the backend with the style attribute allowed. This issue may allow an attacker to enumerate files in the system, including project dependencies, to gather details about the file system structure and dependencies of...