CVE-2020-15115

CVE-2020-15115 is an etcd password-management vulnerability affecting versions prior to 3.3.23 and 3.4.10, where there is no password length validation. The description indicates an attacker could brute-force or guess short passwords (potentially length 1) with little computational effort. The co...

phpList 3.5.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: phpList 3.5.0 - Authentication Bypass Exploit Author: Suvadip Kar Author Contact: https://twitter.com/spidersec Vendor Homepage: https://www.phplist.org Software Link: https://www.phplist.org/download-phplist/ Version: 3.5.0...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.11.0: Never allow an empty password to validate 9682 9683 Prevent redirect to Host 9678 9679 Swagger hide search field 9554 Add "search" to reserved usernames 9063 Switch to fomantic-ui 9374 Only serve attachments when linked to issue/release and if accessible...

Code injection

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10791

CVE-2016-10791 affects cPanel before 60.0.15. The issue arises because the product does not ensure that system accounts lack a valid password, which can render logins impossible (CPANEL-9559). Connected sources consistently describe the same flaw, with no explicit details on affected versions bey...

CVE-2019-9884

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

CVE-2019-9884

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

Design/Logic Flaw

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

CVE-2019-9884 eClass platform contains a Broken Access Control vulnerability

eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...

CVE-2019-9884

CVE-2019-9884 affects the eClass platform (version

PT-2021-7981 · Apache · Apache Kafka

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 2.0.0 through 2.8.0 Description: The issue in Apache Kafka is related to the disclosure of information through inconsistency, allowing a remote attacker to perform a brute force attack. Some components in Apache Kafka us...

HackerOne: Password not checked when disabling 2FA on HackerOne

Hi, when I was submitted a report to a program that request 2FA ON, I notice that if you try to disable this option will ask for backup code - password and if you enter a random password in the request filed and a correct backup code it will be successfully disabled the 2FA without check if the...

Privilege Escalation

craftcms/cms is vulnerable to privilege escalation. The vulnerability exists because it does not validate the original user's password and expects impersonated user's password...

Mac OS X libxpc MITM Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The tasksetspecialport API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap...

Applayering 4.11- unable to add pvs connector

while adding a pvs connector, we get an error as Failed to validate the Domain User and Password. Check credentials .One or more of the PVS server configuration fields is invalid. Please check your selections...

ovirt-aaa-jdbc-tool unauthorized access vulnerability

ovirt-aaa-jdbc-tool tools is a tool for storing authentication and authorization data in a database. A security vulnerability exists in versions of ovirt-aaa-jdbc-tool tools prior to 1.1.3, which stems from the program failing to properly verify that the current password is not invalid. An attack...

Plone and Zope2 affected by Race Condition

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...

Liberapay: Insecure Account Deletion

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account passwor...

WatchGuard AP100, AP102 and AP200 Security Bypass Vulnerabilities

The WatchGuard AP100, AP102 and AP200 are all different series of indoor wireless access point devices from WatchGuard USA. A security vulnerability exists in the WatchGuard AP100, AP102, and AP200, AP300 that stems from the program failing to properly validate the 'old password' field in the...

CVE-2018-10578

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field...