12564 matches found
Authentication flaw
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username...
CVE-2019-13383
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response...
CVE-2019-1575
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API in PAN-OS and...
CVE-2019-1575
CVE-2019-1575 is a PAN-OS information disclosure affecting PAN-OS 7.1.x before 7.1.24, 8.0.x before 8.0.19, 8.1.x before 8.1.8-h5, and 9.0.x before 9.0.2-h4. An authenticated user with read-only privileges could extract the device API key and/or username/password from the XML API, potentially ena...
Information Disclosure in PAN-OS Management API Usage
An Information Disclosure vulnerability exists in PAN-OS Management API usage Ref PAN-107239 and PAN-118869 / CVE-2019-1575 Successful exploitation may allow for an authenticated user with read-only privileges to extract the API key of the device and the username/password from the XML API in PAN-...
PT-2019-4353 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: The issue is related to the login process in CentOS Web Panel, which allows attackers to determine whether a username is valid by analyzing the HTTP response. This is due to a lack of protection...
PT-2019-4355 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.836 Description: The issue is related to weaknesses in the authentication procedure of the CentOS Web Panel application. It allows a remote attacker to bypass authentication in the login process by leveraging...
MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting
MyT Project Management 1.5.1 - Userusername Persistent Cross-Site Scripting Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link:...
Insecure Access Controls
mediawiki/core uses insecure access controls. Unauthorized users are able to retrieve suppressed username or log in Special:EditTags information...
DEBIAN-CVE-2019-12469
MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...
CVE-2019-12469
MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...
CVE-2019-3950
Arlo Basestation firmware 1.12.0.127940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to...
Authentication Bypass
geronimo is vulnerable to authentication bypass. A remote attacker is able to bypass the login function by attempting to login using a non-existent username...
The vulnerability of the FTP server of the IDAL user interface design tool, PB610 Panel Builder 600 (SAP500900R0101), allows a hacker to execute arbitrary code or cause a failure in the FTP server’s operation.
The vulnerability of the FTP server of the IDAL user interface design tool, PB610 Panel Builder 600 SAP500900R0101, is related to errors in processing strings containing the username during authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...
FreeBSD : mediawiki -- multiple vulnerabilities (3c5a4fe0-9ebb-11e9-9169-fcaa147e860e)
MediaWiki reports : Security fixes : T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover. T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS by querying the entire watchlist...
CVE-2019-7272
Optergy Proton/Enterprise devices allow Username Disclosure...
CVE-2019-7272
Optergy Proton/Enterprise devices allow Username Disclosure...
Design/Logic Flaw
Optergy Proton/Enterprise devices allow Username Disclosure...
CVE-2019-7272
CVE-2019-7272 affects Optergy Proton/Enterprise (versions ≤ 2.3.0a). The vulnerability is an information exposure via the username reset functionality, enabling an unauthorized attacker to enumerate usernames and, per Red Hat/CISA references, reveal internal details on the targeted system. Public...