271 matches found
CVE-2025-0361
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API...
CVE-2025-0361
CVE-2025-0361 describes a vulnerability in Axis Communications’ VAPIX Device Configuration framework where unauthenticated username enumeration is possible via the VAPIX Device Configuration SSH Management API. Affected component is the VAPIX Device Configuration framework (Axis OS context cited ...
PT-2025-15356 · Axis Communications · Vapix Device Configuration Framework
Name of the Vulnerable Software and Affected Versions: Axis Communications VAPIX Device Configuration framework affected versions not specified Description: The issue concerns a flaw in the VAPIX Device Configuration framework, allowing unauthenticated username enumeration. This is achieved throu...
WordPress plugin SMM API 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
MAL-2025-2823 Malicious code in @uniqa/security-code-ms-api (npm)
--- -= Per source details. Do not edit below this line.=-...
Account Enumeration
umbraco.cms is vulnerable to Account Enumeration. The vulnerability is due to discrepancies in response codes and the timing of Umbraco management API responses, which allow attackers to infer the existence of specific accounts...
GHSA-HMG4-WWM5-P999 Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes
Impact Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists. Patches Patched in 14.3.2 and 15.1.2. Workarounds None available...
CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...
CVE-2025-24011
Summary: CVE-2025-24011 affects Umbraco CMS (.NET). From 14.0.0 up to, but not including, 14.3.2 and 15.1.2, an attacker can determine whether an account exists by analyzing response codes and timing of the management API. Impact: information exposure; no availability/integrity impact claimed. Ve...
CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...
Umbraco 信息泄露漏洞
Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. An information disclosure vulnerability exists in Umbraco version 14.0.0 and earlier, which stems from the ability to determine the existence of an account based on an analysis of the response code and the...
CVE-2023-29117
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system...
CVE-2023-29117 Authentication Bypass in JuiceBox Web Manager interface
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system...
GHSA-78WR-2P64-HPWJ vulnerabilities
Vulnerabilities for packages: celeborn, sonarqube, hadoop-fips, confluent-common-docker, kserve-modelmesh, confluent-kafka, opensearch, hadoop-client-modules, apache-nifi, logstash, management-api-for-apache-cassandra-4.1, zookeeper, kafka, zookeeper-fips, kserve,...
CVE-2024-47554 vulnerabilities
Vulnerabilities for packages: celeborn, sonarqube, hadoop-fips, confluent-common-docker, kserve-modelmesh, confluent-kafka, opensearch, hadoop-client-modules, apache-nifi, logstash, management-api-for-apache-cassandra-4.1, zookeeper, kafka, zookeeper-fips, kserve,...
CVE-2024-46999
CVE-2024-46999 : Zitadel’s user grants deactivation did not work, allowing deactivated grants to remain in tokens and potentially grant access to apps/resources. The issue affected multiple older releases; management/auth API could return an active state or lack state information. Affected versio...
Information Disclosure
umbraco.cms is vulnerable Information Disclosure. The vulnerability is due to improper handling of error responses in the Management API, which causes stack trace information to be returned even when Umbraco is not in debug mode. It allows an attacker to gain access to internal details of the...
Generation of Error Message Containing Sensitive Information
Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Generation of Error Message Containing Sensitive Information. An attacker can obtain stack trace information that may include sensitive data by...
Generation of Error Message Containing Sensitive Information
Overview Affected versions of this package are vulnerable to Generation of Error Message Containing Sensitive Information. An attacker can obtain stack trace information that may include sensitive data by sending crafted requests to the Management API endpoints. Remediation Upgrade...
