2807 matches found
Design/Logic Flaw
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails...
CVE-2016-9839
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails...
CVE-2016-9839
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails...
Nextcloud: Login Hints on Admin Panel
Hi, Hope you are doing fine. I wanted to inform you regarding the enabling of the login hints on your wp-admin panelhttps://nextcloud.com/wp-login.php. Vulnerability: The admin panel shows very "specific" hint information if a hacker tries for a bruteforcing attack. Steps to reproduce: 1. Navigat...
SSRF Team Calendars
The following endpoint has an SSRF that can be used to enumerate internal network resources that are not publicly exposed to the internet. noformat PUT /wiki/rest/calendar-services/1.0/calendar/subcalendars.json noformat PoC Using the "Team Calendar" macro, select the "Subscribe by URL" option...
Server: Reflected XSS in Gallery application
The gallery app was not properly sanitizing exception messages from the ownCloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability. For more information please consult the official advisory. This advisory is...
IBM Security Guardium Information Disclosure Vulnerability
IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. IBM Security Guardium suffers from an information disclosure vulnerability. A remote attacker could...
Magento Community Edition 2.x < 2.0.6 Multiple Vulnerabilities
Binary data 9694.prm...
Magento Community Edition < 1.9.2.2 Multiple Vulnerabilities
Binary data 9678.prm...
Oracle MySQL 5.6.x < 5.6.30 Multiple Vulnerabilities
Binary data 9611.prm...
Oracle MySQL 5.7.x < 5.7.12 Multiple Vulnerabilities
Binary data 9615.prm...
IBM Security Identity Manager Virtual Appliance Information Disclosure Vulnerability (CNVD-2016-06940)
IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...
CVE-2016-6145
The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...
Moodle 2.8.x < 2.8.12 / 2.9.x < 2.9.6 / 3.0.x < 3.0.4 Multiple Vulnerabilities
Binary data 9427.prm...
Ian Dunn: User enumeration in wp-admin
Hi, I have found that in the page wp-admin possible to perform user enumeration though differences in error massages: if user exist the site will return :" ERROR: The password you entered for the username admin is incorrect." if user not exit: Invalid username...
The vulnerability of the Thunderbird email client, which allows a malicious actor to gain access to authentication data
The Mozilla Thunderbird email client contains a vulnerability related to errors in the implementation of the Web Workers technology. Exploiting this vulnerability allows malicious actors operating remotely to circumvent Domain Restrictions Policy SOP rules and gain access to authentication data...
Unable to View Connection String for Veeam Reporter and Veeam Business View Websites in IIS Manager
Challenge When trying to view connection strings for Veeam Reporter and Veeam Business View websites in IIS manager, the following error messages pop up: Cause Veeam ONE encrypts these configuration settings. Solution This behavior is the product design. More Information If you have any questions...
Moodle Information Disclosure Vulnerability (CNVD-2016-03329)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. An information disclosure vulnerability exists in Moodle. An attacker can exploit this...
DEBIAN-CVE-2016-4561
Cross-site scripting XSS vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message...
