164 matches found
CVE-2024-34024
Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not...
Fujitsu ID Link Manager and Fujitsu TIME CREATOR Security Vulnerability
Fujitsu ID Link Manager and Fujitsu TIME CREATOR are both products of Fujitsu, Japan.Fujitsu ID Link Manager is an ID manager.Fujitsu TIME CREATOR is a business content management software. A security vulnerability exists in Fujitsu ID Link Manager and Fujitsu TIME CREATOR. An attacker could...
JVN#65171386: Multiple vulnerabilities in ID Link Manager and FUJITSU Software TIME CREATOR
ID Link Manager and FUJITSU Software TIME CREATOR provided by Fsas Technologies Inc. contain multiple vulnerabilities listed below. Path Traversal CWE-36 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Base Score 8.6 CVE-2024-33620 Missing Authentication CWE-306...
PT-2024-25651 · Fujitsu · Fujitsu Software Time Creator
Name of the Vulnerable Software and Affected Versions: ID Link Manager affected versions not specified FUJITSU Software TIME CREATOR affected versions not specified Description: The issue allows an unauthenticated remote attacker to determine if a username is valid or not by exploiting an...
CVE-2023-44421
D-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this...
CVE-2024-29296
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not...
BIT-MEDIAWIKI-2020-35623
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a simila...
Customer Support System 安全漏洞
Customer Support System is a customer support system by oretnom23 Personal Developer that helps a particular business or company to provide customer support after a customer has purchased a product from them. Customer Support System suffers from a SQL injection vulnerability that originates from...
CVE-2024-22647
An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...
CVE-2023-49443
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS version v2.1.8, which originates from reusing the same code to validate a valid username and password. An attacker could exploit the vulnerability to gain...
PT-2023-9659 · Mendix · Mendix Runtime
Name of the Vulnerable Software and Affected Versions: Mendix Runtime V10 versions prior to V10.17.0 Mendix Runtime V10.12 versions prior to V10.12.11 Mendix Runtime V10.6 versions prior to V10.6.19 Mendix Runtime V8 versions prior to V8.18.33 Mendix Runtime V9 versions prior to V9.24.31...
CVE-2023-47102
UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid...
SUSE CVE-2015-5189
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated...
D-Link DIR-X3260 Command Injection Vulnerability
The D-Link DIR-X3260 is a mainstream router from D-Link that supports Wi-Fi 6. The D-Link DIR-X3260 suffers from a command injection vulnerability that stems from the SetTriggerPPPoEValidate username command injection remote code execution vulnerability. An attacker can exploit this vulnerability...
CVE-2023-38890
Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...
CVE-2023-33964 mx-chain-go does not treat invalid transaction with wrong username correctly
mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor...
Information Disclosure
jenkins is vunerable to Information Disclosure. The vulnerability exist due to a lack of validation in username which allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security...
GHSA-9GRJ-J43M-MJQR Observable timing discrepancy allows determining username validity in Jenkins
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This...