12558 matches found
Denial of service
Cryptocat before 2.0.22 has Remote Denial of Service via username...
CVE-2013-4100
Cryptocat before 2.0.22 has Remote Denial of Service via username...
FusionPBX Command exec.php Command Execution
This module uses administrative functionality available in FusionPBX to gain a shell. The Command section of the application permits users with execview permissions, or superadmin permissions, to execute arbitrary system commands, or arbitrary PHP code, as the web server user. This module has bee...
CVE-2019-16907
An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI...
CVE-2019-18360
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...
CVE-2019-18360
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...
Design/Logic Flaw
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...
CVE-2019-18360
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery...
CVE-2019-18360
JetBrains Hub is affected by CVE-2019-18360 in versions earlier than 2019.1.11738. The issue enables username enumeration through the password-recovery flow, representing an information-disclosure vulnerability in Hub. Public sources (JetBrains Security Bulletin Q3 2019 and Red Hat/CNVD entries) ...
CVE-2019-7619
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...
CVE-2019-7619
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...
CVE-2019-7619
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...
Design/Logic Flaw
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...
CVE-2019-7619
CVE-2019-7619 affects Elasticsearch versions 7.0.0–7.3.2 and 6.7.0–6.8.3, where an unauthenticated attacker could use the API Key service to determine if a username exists in the native realm due to a username-disclosure flaw. The connected documents corroborate a username disclosure vulnerabilit...
CVE-2019-7619
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...
Ajenti 2.1.31 Remote Code Execution
Exploit Title: Ajenti 2.1.31 - Remote Code Exection Metasploit Date: 2019-10-29 Exploit Author: Onur ER Vendor Homepage: http://ajenti.org/ Software Link: https://github.com/ajenti/ajenti Version: 2.1.31 Tested on: Ubuntu 19.10 This module requires Metasploit: https://metasploit.com/download...
CVE-2018-18929
The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username a...
CVE-2016-2356
Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password...