Observium SQL Injection Vulnerability

Observium is a low-maintenance auto-discovery network monitoring platform that supports multiple device types, platforms and operating systems. Observium suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to inject malicious SQL statements via username0 of the...

CVE-2020-25147

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username0 to the default URI, because of...

The ugidd RPC interface by design allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.

...

IBM Data Risk Manager Information Disclosure Vulnerability

IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. An information disclosure vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit this vulnerability to obtain sensitive username information via a...

Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability

Talos Vulnerability Report TALOS-2020-1097 Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability September 23, 2020 CVE Number CVE-2020-6153 Summary An exploitable SQL injection vulnerability exists in the FavoritesService.asmx Web Service functionality of eDNA...

CVE-2020-4616

IBM Data Risk Manager iDNA 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929...

Denial Of Service (DoS)

firefox is vulnerable to denial of service DoS. The vulnerability exists when a long user name is used in a username/password combination in a site URL, such as http://UserName:[email protected]", causing the resulting modal prompt to be in a non-responsive state or crash...

Heybbs SQL Injection Vulnerability

HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A SQL injection vulnerability exists in the login.php file of Heybbs version 1.2. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of...

This One Time on a Pen Test: Outwitting the Vexing VPN

Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. Just...

CVE-2020-13289

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated...

PT-2020-13430 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered in certain cases where an invalid username could be accepted when 2FA is activated. Recommendations:...

Exposure of Sensitive Information to an Unauthorized Actor in traduora/traduora

Description Username Enumeration in traduora. Proof of Concept 1. setup traduora to reproduce the vulnerability 2. go to sign in page http://localhost:8080/login 3. Append non registered user email and password it shows Error,resource not found 4. when Appending correct username and fake password...

CVE-2020-24197

A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter...

CVE-2020-24197

A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter...

Siemens Spectrum Power™ 4 Unsecure Storage of Sensitive Information Vulnerability

Spectrum Power™4 provides the basic components for modeling data for SCADA, communications, and control and monitoring systems. A security vulnerability exists in Siemens Spectrum Power™4. An attacker could exploit the vulnerability to cause the retrieval of a username...

CVE-2020-25006

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-23811

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java...

CVE-2020-23830

A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...

CVE-2020-23830

A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...