CVE-2021-45925 Username Enumeration

Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0...

CVE-2022-2373

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address...

The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules lies in the exposure to information leakage due to inconsistencies in the system. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules is related to the exposure of information through incompatibility issues. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the Inter-controller protocol implementation in Honeywell’s programmable logic controllers’ microprogramming software arises from the transmission of PIN codes, user names, and passwords as plain text. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Inter-controller protocol implementation for Honeywell programmable logic controllers involves the transmission of PIN codes, user names, and passwords as plain text. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protect...

Gentics Software Gentics CMS 跨站脚本漏洞

Gentics Software Gentics CMS is a digital publishing and content management system from the Austrian company Gentics Software. A cross-site scripting vulnerability exists in Gentics CMS version 5.36.29. An attacker can exploit this vulnerability to store malicious JavaScript code in user names an...

Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting XSS vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or...

GHSA-QQ38-MXPQ-RRPJ Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin

GitLab Authentication Plugin 1.5 and earlier does not differentiate between user names and hierarchical group names when performing authorization. This allows an attacker with permissions to create groups in GitLab to gain the privileges granted to another user or group. GitLab Authentication...

GHSA-VR6V-WJFW-RXCR Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin

Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting XSS vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or...

GHSA-FXQR-PX2M-FVC2 Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...

Moodle Global search displays user names for unauthenticated users

In Moodle 3.2.x, global search displays user names for unauthenticated users...

GHSA-98MF-MQW9-9Q8Q Moodle Global search displays user names for unauthenticated users

In Moodle 3.2.x, global search displays user names for unauthenticated users...

GHSA-M646-H2PW-56H4 Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords

The Front End User Registration srfeuserregister extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the 1 edit perspective or 2 autologin feature...

Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords

The Front End User Registration srfeuserregister extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the 1 edit perspective or 2 autologin feature...

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into...

Opencast has Incorrect Permission Assignment

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

GHSA-HX44-C87V-P6XG Opencast has Incorrect Permission Assignment

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

GHSA-JFF5-55XJ-4JCQ Improper Neutralization of Input During Web Page Generation in Jenkins

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names SECURITY-388...

Moodle XSS Vulnerability

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its acces...

PT-2022-15687 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: Sysaid – Pro Plus Edition versions v20.4.74 b10 through v22.1.30 b49 Description: The issue allows an attacker to bypass access controls by logging in as a guest and manipulating the URL path to access the system dashboard. The attacker can...

WordPress plugin Amelia 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Amelia plugin is vulnerable to an...