12559 matches found
White Shark System (WSS) Sensitive Information Disclosure Vulnerability
White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A sensitive information disclosure vulnerability exis...
[ASA-202106-52] helm: information disclosure
Arch Linux Security Advisory ASA-202106-52 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32690 Package : helm Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2078 Summary ======= The package helm before version...
CVE-2020-20472
White Shark System WSS 1.3.2 has a sensitive information disclosure vulnerability. The ifgetaddbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site...
CVE-2020-20472
White Shark System WSS 1.3.2 has a sensitive information disclosure vulnerability. The ifgetaddbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site...
Information disclosure
White Shark System WSS 1.3.2 has a sensitive information disclosure vulnerability. The ifgetaddbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site...
CVE-2020-20472
CVE-2020-20472 affects White Shark System (WSS) 1.3.2. The vulnerability is in if_get_addbook.php, which operates without authentication, allowing remote attackers to obtain username information for all users on the current site. The condition arises from lack of access control on that endpoint (...
White Shark System 访问控制错误漏洞
White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A sensitive information disclosure vulnerability exis...
CVE-2020-25754
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...
CVE-2021-28857
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie...
CVE-2021-34540
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...
Cross site scripting
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard...
CVE-2021-21664
An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored i...
CVE-2021-21663
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in...
CVE-2021-21665
A cross-site request forgery CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins...
CVE-2021-21663
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in...
CVE-2021-21664
An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored i...
Default credentials
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in...
CVE-2021-21665
A cross-site request forgery CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins...
CVE-2021-21663
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in...
PT-2021-14706 · Xebialabs +1 · Jenkins Xebialabs Xl Deploy Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins XebiaLabs XL Deploy Plugin versions 7.5.8 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs...