GHSA-3WJM-33MW-H388 Malicious Package in s3asy

Version 0.4.8 of s3asy contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.4.8 of this module is found installed you will want ...

Malicious Package in react-dates-sc

Version 0.3.0 of react-dates-sc contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.3.0 of this module is found installed you...

PT-2020-13916

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 7.13.7 Atlassian Jira Server and Data Center versions 8.0.0 through 8.5.7 Atlassian Jira Server and Data Center versions 8.6.0 through 8.11.9 Description The issue allows remote attackers...

CVE-2020-14178: Undefined Security Weakness

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 befo...

Linux Container Enumeration

This module attempts to enumerate containers on the target machine and optionally run a command on each active container found. Currently it supports Docker, LXC and RKT. Module Options msf use post/linux/gather/enumcontainers msf postenumcontainers show actions ...actions... msf postenumcontaine...

CVE-2020-11625

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate wheth...

CVE-2020-11437

LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database...

PT-2020-12606

Name of the Vulnerable Software and Affected Versions LibreHealth EMR version 2.0.0 Description The issue allows low-privilege authenticated users to perform SQL injection, enabling them to enumerate the database. Recommendations For LibreHealth EMR version 2.0.0, at the moment, there is no...

CVE-2020-4029: Undefined Security Weakness

The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability...

PT-2020-17843

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.5.5 Atlassian Jira Server and Data Center versions 8.6.0 through 8.7.1 Atlassian Jira Server and Data Center versions 8.8.0 Description The issue allows remote attackers to enumerate...

Authorization

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are...

CVE-2020-2188

A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2020-11453

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit ...

LabVantage LIMS Information Disclosure Vulnerability

LabVantage Solutions LIMS is a laboratory letter management system from LabVantage Solutions in the United States. An information disclosure vulnerability exists in LabVantage LIMS 8.3. The vulnerability stems from LabVantage LIMS failing to properly maintain the confidentiality of database names...

LabVantage 8.3 - Information Disclosure

Exploit Title: LabVantage 8.3 - Information Disclosure Google Dork: N/A Date: 2020-02-16 Exploit Author: Joel Aviad Ossi Vendor Homepage: labvantage.com Software Link: N/A Version: LabVantage 8.3 Tested on: CVE : N/A import requests import operator def exploittarget: print"+ Fetching LabVantage...

PT-2020-10336

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.7.0 Description The issue allows an attacker to exploit cross-site request forgery CSRF in the VerifySmtpServerConnection!add.jspa component. This can be achieved by tricking an...

PT-2020-7226

Name of the Vulnerable Software and Affected Versions Arial Campaign Enterprise versions prior to 11.0.551 Description The issue allows remote attackers to enumerate users' credentials due to unauthorized access to the User-Edit.asp page. Recommendations For versions prior to 11.0.551, update to...

SQLMap v1.4 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

CVE-2019-18334

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to enumerate valid user names by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs to...

PT-2019-15354

Name of the Vulnerable Software and Affected Versions SPPA-T3000 Application Server versions prior to Service Pack R8.2 SP2 Description A security issue has been identified that allows an attacker with network access to the Application Server to enumerate valid user names by sending specifically...