SiPass integrated access control vulnerability (CNVD-2021-100377)

SiPass integrated is an access control system. With the SiPass integrated access control vulnerability, an affected application has insufficiently restricted access to internal user authentication services. A remote attacker could exploit the vulnerability to trigger multiple operational accounts...

Unspecified Vulnerability in Couchbase Server

Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . Couchbase Server has a security vulnerability that can be exploited by an attacker ...

Design/Logic Flaw

An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @nsserver, leaks credentials in cleartext in the cbcollectinfo.log, debug.log, nscouchdb.log, indexer.log, and stats.log files. NOTE:...

Couchbase Server 安全漏洞

Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . Couchbase Server has a security vulnerability that can be exploited by an attacker ...

CVE-2019-14477

AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted...

AdRem NetCrunch Trust Management Issues Vulnerability

Adrem Netcrunch is a device monitoring software from the American company Adrem. The software monitors Windows, Linux, Mac OS X, BSD, NetWare, and SNMP devices based on SNMP sources, Windows event logs, and Syslog servers. AdRem NetCrunch 10.6.0.4587 suffers from a Trust Management Issue...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

Genius Bytes Genius Server usrInternalUsrCRUD plugin elevation of privilege vulnerability

Genius Bytes Genius Server is a set of data platforms for connecting IT infrastructure components from Genius Bytes Germany. usrInternalUsrCRUD is one of the internal user CRUD Create, Read, Update and Delete plug-ins. A security vulnerability exists in the usrInternalUsrCRUD plugin in Genius Byt...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13420

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

Default credentials

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13421

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database...

CVE-2019-13420

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

CVE-2019-13420

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

Code injection

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

CVE-2019-13420

CVE-2019-13420 affects floragunn Search Guard (Elasticsearch/ELK plugin) prior to version 21.0. The vulnerability is a timing side-channel in the internal user database, which could leak information and impact confidentiality. The detail provided specifies the root cause as a timing discrepancy w...

CVE-2019-13420

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

CVE-2018-15635

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a...

Cross site scripting

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a...