84 matches found
EUVD-2023-49661
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-30597
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. CVE-2022-30597 Note that Nessus relies on the...
Linux Distros Unpatched Vulnerability : CVE-2020-35480
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki before 1.35.1. Missing users accounts that don't exist and hidden users accounts that have been explicitly hidden due to...
Linux Distros Unpatched Vulnerability : CVE-2021-30156
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a hidden user exists...
CVE-2021-30153
An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. It shouldn't because the...
CVE-2020-12848
In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password a...
The vulnerability of the OData protocol implementation in SAP S4CORE Entity software allows unauthorized access to protected information.
The vulnerability of the OData protocol implementation in SAP S4CORE Entity software is related to deficiencies in displaying hidden user fields. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2024-10773
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device...
CVE-2024-10773 SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks
The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device...
PT-2024-16533 · Sick · Sick Tim3Xx +2
Name of the Vulnerable Software and Affected Versions: SICK InspectorP61x versions affected versions not specified SICK InspectorP62x versions affected versions not specified SICK TiM3xx versions affected versions not specified Description: The product is vulnerable to pass-the-hash attacks in...
CVE-2024-43429 Moodle: user information visibility control issues in gradebook reports
A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information...
PT-2024-8619 · Moodle +2 · Moodle +2
Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw in Moodle allows hidden user profile fields to be visible in gradebook reports. This could result in users without the view hidden user fields capability having access to confidential...
The vulnerability of the PageTriage extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to gain unauthorized access to protected information.
The vulnerability of the PageTriage extension of the software platform for implementing the MediaWiki hypertext environment is related to the exposure of hidden users’ names. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information remotely...
ROS-20240505-13
A vulnerability in the Wikibase extension of the MediaWiki hypertext environment implementation software tool is related to the lack of restrictions on the speed of merging elements no. Exploitation of the vulnerability could allow an attacker acting remotely to affect the integrity and...
Nats-Server Security Vulnerability
Nats-Server is a high performance server for Nats.io, cloud and edge native messaging systems. A security vulnerability exists in Nats-Server versions prior to 2.9.23, and 2.10.x prior to 2.10.2, which stems from the presence of an authentication bypass that allows an attacker to bypass...
CVE-2023-45369
An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed...
MediaWiki < 1.31.12 Special Contributions Hidden User Leakage
According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.31.12 or 1.32.x prior to 1.35.2. It is, therefore, affected by a vulnerability in Special:Contributions that can leak that hidden users exist. Note that the scanner has not teste...
UBUNTU-CVE-2023-37300
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users...
MediaWiki 安全漏洞
MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems.CheckUser extension is one of the user information checking extensions. A security vulnerability...