1336 matches found
HackerOne: Making any Report Failed to load
Hello, I found a way to make any report failed to load using this code with Hex Character: www.%40ebаy.com I was testing for Homographic Issue using Hex Characters and I listed all of hex character and tried to bypass. Then, when I paste the list and comment it in a report I experienced report...
Code injection
IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...
Moodle 2.7.x < 2.7.1 XSS
Binary data 8717.prm...
Shopify: Authentication Failed Mobile version
1 access shopify.com login 2 access your profile change password Insert a new password and select the 'Also log out of your store on Shopify Mobile and / or Shopify POS' field. In my test session was not closed in mobile version for Android. Please check it...
CVE-2015-1227
Removed by vendor...
Apple iOS 8.x < 8.1.1 Multiple Vulnerabilities.
Binary data 8940.prm...
SSH Login Failed For Authenticated Checks
It was NOT possible to login using the provided SSH credentials. Hence authenticated checks are NOT enabled. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
failedloginattempts v1.0.1
plgfailedloginattemptsv1.0.1j25j30, 1.0.1, Information Disclosure Developers update statements 12-Dec-2014 : v1.1.0 http://www.web357.eu/news/releases/68-failed-login-attempts-v1-1-0-has-been-released-security-release.html...
Microsoft Windows Remote Desktop Protocol Security Feature Bypass Vulnerability (3003743)
This host is missing an important security update according to Microsoft Bulletin MS14-074. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2014-2064
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts...
Design/Logic Flaw
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts...
CVE-2014-2064
The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts...
Authentication flaw
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack...
CVE-2014-3549
Cross-site scripting XSS vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attem...
Cross site scripting
Cross-site scripting XSS vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attem...
Mail.ru: target.mail.ru: XSS через Referer
POST /offer HTTP/1.1 Host: target.mail.ru User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:28.0 Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...
Live for Speed Skin Name Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26066/info Live for Speed is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploi...
Avahi < 0.6.24 (mDNS Daemon) Remote Denial of Service Exploit
No description provided by source. / cve-2008-5081.c Avahi mDNS Daemon Remote DoS 0.6.24 Jon Oberheide [email protected] http://jon.oberheide.org Usage: gcc cve-2008-5081.c -ldnet -o cve-2008-5081 ./cve-2008-5081 1.2.3.4 Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5081...
Duyuru Scripti Goster.ASP SQL injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22910/info Duyuru Scripti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remot...
Jieqi CMS <= 1.5 - Remote Code Execution Exploit
No description provided by source. ?php printr' +---------------------------------------------------------------------------+ Jieqi cms = 1.5 remote code execution exploit by Securitylab.ir mail: [email protected] +---------------------------------------------------------------------------+ '; ...