ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution Exploit

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager v12.4x - Unauthenticated Remote Command Execution", 'Description' = %q This module bypasses the user password requirement i...

cPanel Input Validation Error Vulnerability (CNVD-2019-29604)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 68.0.15, which stems from the program allowing user accounts to be...

CVE-2017-18465

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

CVE-2017-18465

cPanel before 62.0.17 does not have a sufficient list of reserved usernames SEC-227...

GSA Bounty: Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov

Hi Team, I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username on data.gov x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33184/mtime:1513269652/atime:1513269652/md5:2049644b6b833f5dbb826f60a4721f64/ctime:1513269652 Server:...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

Design/Logic Flaw

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

Design/Logic Flaw

cPanel before 68.0.15 does not block a username of ssl SEC-328...

CVE-2017-18401

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats SEC-334...

CVE-2017-18401

CVE-2017-18401 affects cPanel prior to 68.0.15, where account creation could partially succeed with invalid username formats (SEC-334). The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD). A patch to 68.0.15 or later is the stated remediation in available references; no exp...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

CVE-2017-18395

CVE-2017-18395 affects cPanel before 68.0.15, where the system does not block a username of ssl (SEC-328). This is corroborated by Red Hat and other records in the connected data. Public details describe the issue but do not provide a patch or remediation steps within the supplied documents. CVSS...

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail SEC-326...

CVE-2016-10833

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...

CVE-2016-10833

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...

CVE-2016-10833

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd SEC-104...

CVE-2019-12743

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits including self-hosted ones by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure...