CVE-2022-32741

Attacker is able to determine if the provided username exists and it's valid using Request New Password feature, based on the response time...

CVE-2022-32741 Information disclosure in Request New Password feature

Attacker is able to determine if the provided username exists and it's valid using Request New Password feature, based on the response time...

CVE-2022-32741

The CVE-2022-32741 entry concerns OTRS (versions 7.x up to 7.0.35 and 8.x up to 8.0.23) where the Request New Password feature can leak valid usernames via response-time differences, enabling user enumeration. The root cause is timing-based information disclosure in the password-reset flow. The p...

PT-2022-17336

Name of the Vulnerable Software and Affected Versions FreeTAKServer-UI version 1.9.8 Description The issue is a SQL injection vulnerability that can be exploited via the API endpoint /AuthenticateUser. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized acces...

PT-2022-12353 · Sourcecodester · Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Cold Storage Management System version 1.0 Description: An SQL Injection issue exists in the login functionality, specifically through the username field in the login.php file. This allows for potential unauthorized acce...

CVE-2021-41871

An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS payload. This is executed if an administrator views the System Event Log...

CVE-2021-44155

An issue was discovered in /goform/loginprocess in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users...

Use of a Broken or Risky Cryptographic Algorithm in anonaddy/anonaddy

Description MD5 and SHA-1 are popular cryptographic hash algorithms often used to verify the integrity of messages and other data. Recent advances in cryptanalysis have discovered weaknesses in both algorithms. Consequently, MD5 and SHA-1 should no longer be relied upon to verify the authenticity...

Opennms Group OpenNMS 跨站请求伪造漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based OpenNMS Group Opennms Group. A security vulnerability exists in OpenNMS Horizon that stems from the lack of CSRF protection and failure to validate existing usernames whe...

Security vs User Journey

Something I often think about is how my recommendations for clients to fix small security issues can spoil / complicate their users journey. UX matters I understand that UX is hugely important, even subtle changes can influence whether a journey is completed or abandoned. The difference between...

Atlassian JIRA < 8.5.13 / 8.6.x < 8.13.5 / 8.14.x < 8.15.1 Multiple Vulnerablities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is affected by multiple vulnerabilities. - The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from versi...

CVE-2020-36238

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

CVE-2020-36238

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

Design/Logic Flaw

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

MediaWiki suffers from an unspecified vulnerability (CNVD-2021-38678)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and prior version...

CVE-2020-35623

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a simila...

Input validation

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a simila...

CVE-2020-35623

CVE-2020-35623 (MediaWiki CasAuth extension) : The vulnerability affects MediaWiki with the CasAuth extension up to version 1.35.1, caused by improper username validation. This can allow an ordinary user to impersonate a “bureaucrat user” whose username differs only by characters such as bidirect...

CVE-2020-35623

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a simila...

MediaWiki 安全漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and prior version...