3413 matches found
CVE-2020-35177
CVE-2020-35177 affects HashiCorp Vault and Vault Enterprise; versions 1.4.1 and later allowed user enumeration through the LDAP authentication method. The issue is mitigated by upgrading to 1.5.6 or 1.6.1, which fix the vulnerability. The available connected documents confirm the vulnerability is...
HashiCorp Vault Information Disclosure Vulnerability
Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp Vault Enterprise version 1.4.1 of Sentinel EGP, which stems from allowing users to be enumerated via the LDAP authentication method...
Vault’s LDAP Auth Method Allows User Enumeration
Summary Vault and Vault Enterprise “Vault” allowed enumeration of users via the LDAP auth method. This vulnerability, CVE-2020-35177, was introduced in Vault 1.4.1 and fixed in Vault 1.6.1 and 1.5.6. Background The Vault LDAP auth method documented at LDAP - Auth Methods | Vault by HashiCorp allo...
CVE-2020-28206
An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...
CVE-2020-28206
An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...
Authentication flaw
An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...
CVE-2020-28206
An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...
CVE-2020-28206
The CVE-2020-28206 entry describes a vulnerability in Bitrix24 Bitrix Framework (1c site management) version 20.0 where a flaw in the admin login form allows user enumeration of administrator-group accounts and enables brute-force attempts on passwords for users not in the administrator group. Th...
Bitrix Framework Security Vulnerability
Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management. A security vulnerability exists in the Bitrix24 Bitrix Framework, which stems from an "improper restrictio...
Joomla 1.7.x < 3.9.23 Multiple Vulnerabilities (5828-joomla-3-9-23)
According to its self-reported version, the instance of Joomla! running on the remote web server is 1.7.x prior to 3.9.23. It is, therefore, affected by multiple vulnerabilities. - The autosuggestion feature of comfinder did not respect the access level of the corresponding terms. - The global...
Automattic: Permanent DoS at https://happy.tools/ when inviting a user
Hi Team, At Happy Tools, I found an exception to the exclusion of denial of service. The web app allows creating an account/login into an account either using Gmail or WordPress. The vulnerability lies in the fact that after registration, a user can change their email without verification. Steps ...
CVE-2020-7962
An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an attacker to detect a valid answer based on the HTTP response content, and reuse this answer later for a password reset on a chosen password. The enumeration is...
Citadel WebCit User Enumeration Vulnerability
WebCit is the Citadel Servlet engine. A user enumeration vulnerability exists in Citadel WebCit 926 and earlier versions. A remote, unauthenticated attacker could exploit this vulnerability to enumerate valid users within the platform to obtain sensitive information...
CVE-2020-27740
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...
CVE-2020-27740
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...
UBUNTU-CVE-2020-27740
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...
CVE-2020-27740
CVE-2020-27740 affects Citadel WebCit up to version 926. The vulnerability lets unauthenticated remote attackers enumerate valid users on the platform, as described in the CVE entry. Public details in the initial document indicate reporting to the vendor in a public thread; no explicit exploit co...
CVE-2020-27740
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...
