3402 matches found
Design/Logic Flaw
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the password recovery...
CVE-2021-44876
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the identification of t...
CVE-2021-44876
Dalmark Systems Systeam 2.22.8 build 1724 ERP is vulnerable to User enumeration due to differing authentication messages during tenant/user validation, enabling a brute-force attack with valid users. Root cause: message-based user existence disclosure during tenant resolution. Impact is stated as...
CVE-2021-44875
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the password recovery...
CVE-2021-44875
CVE-2021-44875 affects Dalmark Systems Systeam 2.22.8 build 1724. The issue is a user-enumeration flaw in the password-recovery flow: the application returns messages that differ depending on whether a user exists, enabling a brute-force attack to identify valid users. The vulnerability is docume...
CVE-2021-35248
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...
CVE-2021-44554
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS Windows through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to...
CVE-2021-44554
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS Windows through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to...
Code injection
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS Windows through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to...
CVE-2021-44554
CVE-2021-44554 affects Thinfinity VirtualUI prior to 3.0. The vulnerability allows an unauthenticated attacker to enumerate Windows OS usernames via the /changePassword URI, returning messages that reveal whether a username exists, with language variation based on VirtualUI configuration (example...
Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Vulnerability
Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed Vendor Homepage: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: vulnerable v3.0 Tested on: Microsoft Window...
Cibele Thinfinity VirtualUI 2.5.41.0 User Enumeration
Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Date: 13/12/2021 Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed Vendor Homepage: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: vulnerable v3.0 Tested on:...
Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Date: 13/12/2021 Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed Vendor Homepage: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: vulnerable v3.0 Tested on:...
PT-2021-23163 · Bookstack · Bookstack
Name of the Vulnerable Software and Affected Versions: BookStack versions prior to 21.11.3 Description: The issue allows a logged-in user with no privileges or a guest user if public access is enabled to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit...
CVE-2021-36721
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...
CVE-2021-36721
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...
Authorization
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...
CVE-2021-36721 Sysaid - Sysaid API User Enumeration
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server...
CVE-2021-36721
SysAid IT service management product: authorization issue in the SysAid API prior to version 21.3.60. Root cause is insufficient authentication on a specific API path, allowing an attacker to retrieve usernames from an LDAP server. Affected: versions before 21.3.60. Impact: potential disclosure o...