Tenable SecurityCenter < 5.7.0 Multiple Vulnerabilites (TNS-2018-11)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is affected by multiple vulnerabilities: - In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of...

OpenSSH 2.3 7.7 - Username Enumeration (PoC)

OpenSSH 2.3 7.7 - Username Enumeration PoC !/usr/bin/env python Copyright c 2018 Matthew Daley Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files the "Software", to deal in the Software without restriction, including...

Passit: app.passit.io is vulnerable against username enumeration

Summary: The application app.passit.io is vulnerable against username enumeration through the use of error messages and dictionary attack. Description: We noted that the application uses GET request with a rate limit of 60 seconds which is too broad. The application returns an error message that...

CVE-2018-15184

PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795...

CVE-2018-15184

PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795...

Cross site scripting

PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795...

CVE-2018-15184

CVE-2018-15184 affects PHP Scripts Mall Naukri/Shine/Jobsite Clone Script, version 3.0.4. The vulnerability is a stored cross-site scripting (XSS) issue in the USERNAME field, as described in multiple sources (notably the CVE entry and CNVD/NVD records). The root cause is input handling that allo...

Code injection

In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue...

CVE-2018-1154

In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue...

CVE-2018-1154

In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue...

CVE-2018-1154

In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue...

CVE-2018-1154

The CVE-2018-1154 issue affects SecurityCenter prior to version 5.7.0, where an unauthenticated attacker could enumerate username aliases by brute-forcing responses, potentially leading to unauthorized access. The issue’s root cause is a username enumeration mechanism; mitigation configured in th...

DEBIAN-CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

CVE-2018-5543

The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 k8s-bigip-crtl passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container...

Core FTP 2.0 - XRMD Denial of Service PoC Exploit

Exploit for windows platform in category dos / poc Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service PoC Exploit Author: Erik David Martin Vendor Homepage: http://www.coreftp.com/ Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe Version: Version 2.0, build 653, 32-bit...

Information disclosure

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or /privacy&terms, as demonstrated by reading database username...

CVE-2018-14328

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or /privacy&terms, as demonstrated by reading database username...

CVE-2018-14328

CVE-2018-14328 affects Brynamics “Online Trade” (online trading/cryptocurrency investment system). Connected sources confirm information disclosure via direct requests to endpoints such as /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, and /privacy&terms, leaking sensit...

WordPress: Open API For Username enumeration

We Can do username enumeration, Reproduce: 1. Go any wordpress site. 2.www.site.com/?author=1 type ?author=1 at end of site 3. You will get www.site.com/author/admin now, admin is username of login panel of that site Thanks, Sameer Phad Impact -...