12558 matches found
CBAS-Web 19.0.0 - Username Enumeration
Exploit Title: CBAS-Web 19.0.0 - Username Enumeration Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/ Version: 19.0.0 Tested on: NA CVE :...
Optergy 2.3.0a - Username Disclosure
Title: Optergy 2.3.0a - Username Disclosure Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: djuro teppi view alerton stef humba drmio de3 andri myko dzonka kosto beebee Administrator...
Optergy 2.3.0a - Username Disclosure
Optergy 2.3.0a - Username Disclosure Title: Optergy 2.3.0a - Username Disclosure Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: djuro teppi view alerton stef humba drmio de3 andri myko dzonka kosto beebee...
Computrols CBAS-Web 19.0.0 Username Enumeration
Computrols CBAS-Web Username Enumeration Affected versions: 19.0.0 and below CVE: CVE-2019-10848 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Discovered by Gjoko 'LiquidWorm' Krstic Testing for non-valid...
CBAS-Web 19.0.0 - Username Enumeration
CBAS-Web 19.0.0 - Username Enumeration Exploit Title: CBAS-Web 19.0.0 - Username Enumeration Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/...
EulerOS 2.0 SP5 : cups (EulerOS-SA-2019-2135)
According to the version of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The addjob function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs...
The vulnerability of D-Link DIR-823G router’s microprogramming software lies in the lack of measures to sanitize input data in the Username field. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of D-Link DIR-823G router’s microprogramming software is related to the lack of measures for cleaning incoming data in the Username field. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...
PT-2020-3641 · Roundcube +3 · Roundcube Webmail +3
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5 Description: The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impac...
Cryptocat Input Validation Error Vulnerability
Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in Cryptocat versions prior to 2.0.22. An attacker can exploit this vulnerability to cause a denial of service with a username...
CVE-2019-6122
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
CVE-2019-6120
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...
CVE-2019-6122
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
Code injection
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
Design/Logic Flaw
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...
CVE-2019-6122
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...
CVE-2019-6122
CVE-2019-6122 is a vulnerability in NiceHash Miner prior to 2.0.3.0 causing user enumeration through separate error messages: submitting a non-existent email triggers “EMAIL DOES NOT EXIST,” while valid emails with incorrect credentials yield a different error. This behavioral difference enables ...
CVE-2019-6120
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...
CVE-2019-6120
NiceHash Miner before version 2.0.3.0 is affected by CVE-2019-6120 due to a missing rate limit when adding a wallet via an email address. This enables an attacker to submit many email addresses to identify valid ones, and can be combined with CVE-2019-6122 (Username Enumeration) to enumerate vali...
dovecot: Improper certificate validation
It was discovered that Dovecot incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users...