Information disclosure

IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907...

CVE-2017-1141

IBM Insights Foundation for Energy versions 1.0, 1.5, and earlier (

CVE-2017-1141: Exposure of Sensitive Information to an Unauthorized Actor

IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907...

PT-2017-11991

Name of the Vulnerable Software and Affected Versions IBM Insights Foundation for Energy versions 1.0 through 1.6 Description The issue allows an authenticated user to obtain sensitive information from error messages. Recommendations For versions 1.0 through 1.6, update to a version that includes...

PT-2017-10686 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 9.0.55 Nextcloud Server versions prior to 10.0.2 Description: The issue allows an adversary with access to a write-only share to enumerate the names of existing files and subfolders by comparing exception...

NoSQL Injection

A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation. This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of...

LDAP Injection

Lightweight Directory Access Protocol LDAP is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On SSO service that will allow clients to authenticate with a web site without any interaction assuming...

Information Exposure in JUnit Report Macro

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-52112. panel The JUnit Report Macro throws different error messages for the url parameter code:java file:///no/file/herecode...

Information Disclosure

console-common is susceptible to information disclosure. The vulnerability exists because detailed error messages reveal a REST Endpoint to the user...

Change of Expired LDAP Password on NetScaler During Log On Fails Intermittently

Changing the expired LDAP password at the time of user login via NetScaler Gateway due to password-expiry may fail and demonstrate itself on the login page as: "Incorrect credentials. Try again." or "Cannot connect. Try connecting again." ifEnhanced Authentication Feedback is enabled: At the time...

PYSEC-2017-42

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

PYSEC-2017-42

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...

Navetti PricePoint 4.6.0.0 XSS / CSRF / SQL Injection Vulnerabilities

Exploit for php platform in category web applications title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: - impact: high/critical homepage: http://www.navetti.com/ found: 2016-07-18 by: W. Schober Office Vienna SEC...

Breaking down a notably sophisticated tech support scam M.O.

Note: Our Tech support scams FAQ page has the latest info on this type of threat, including scammer tactics, fake error messages, and the latest scammer hotlines. You can also read our latest blog, New tech support scam launches communication or phone call app. The cornerstone of tech support sca...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2017-01411)

IBM Security Key Lifecycle Manager formerly known as TivoliKeyLifecycleManager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IBM...

CVE-2016-9748

IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the system...

CVE-2016-6094

IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data...

PT-2017-8890

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 2.0.1, 2.5, 2.6 Description The issue generates an error message that includes sensitive information about its environment, users, or associated data. Recommendations For versions 2.0.1, 2.5, and 2.6,...

User enumeration with error messages - ownCloud

This issue occurs at sending a password reset E-Mail, where a difference in error messages could allow an attacker to determine if the username is valid or not Affected Software ownCloud Server 9.1.3 CVE-2017-5865 core/d2f47acb38675d2798fe9e9b6294981f24613d40 ownCloud Server 9.0.7 CVE-2017-5865...