12586 matches found
CVE-2017-7783
If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...
CVE-2010-3845
libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...
PT-2017-5069 · Apache · Apache Cxf
Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.4.5 through 2.5.1 Description: The issue allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request, specifically exploiting the WS-SP UsernameToken policy...
CVE-2017-6752
A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA 9.33 and 9.62 could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the...
GoAhead System.ini Leak
The remote server uses a version of GoAhead that allows a remote unauthenticated attacker to download the system.ini file. This file contains credentials to the web interface, ftp interface, and others. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid102174;...
Cisco Adaptive Security Appliance Username Enumeration Information Disclosure Vulnerability (cisco-sa-20170802-asa2)
A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. Copyright C 2017 Greenbone Networks GmbH Some text...
PT-2017-2627 · Cisco · Cisco Asa
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance versions 9.33 through 9.62 Description: The issue is related to a lack of protection for service data when interacting with the SSL Connection Profile via the LDAP protocol in the web interface of the Cisco...
Reflective XSS Cross-Site Scripting Vulnerability in TRS WCM Content Collaboration Platform
The TRS WCM Content Collaboration Platform TRS WCM is a content management system. The TRS WCM Content Collaboration Platform suffers from a reflected XSS cross-site scripting vulnerability. The UserName fails to effectively filter user-submitted data, allowing an attacker to construct XSS...
Secure Mail: How to edit the MDX file for enabling/disabling the hidden policy.
Enable/Disable the hidden policy for Secure Mail: ex "AutoPopulateusernametitle"...
Synology DiskStation Manager (DSM) Information Disclosure Vulnerability
Synology DiskStation Manager is an operating system for use on networked storage servers NAS. A security vulnerability in Synology DiskStation Manager forgetpasswd.cgi allows remote attackers to submit a special request to enumerate valid usernames...
Information disclosure
An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...
CVE-2017-9554
An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...
TeamTalk Gather Credentials
This module retrieves user credentials from BearWare TeamTalk. Valid administrator credentials are required. This module has been tested successfully on TeamTalk versions 5.2.2.4885 and 5.2.3.4893. This module requires Metasploit: https://metasploit.com/download Current source:...
CVE-2017-11581
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
Cross site scripting
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
CVE-2017-11581
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
PT-2017-19014 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.3-15152 Description: The issue allows remote attackers to enumerate valid usernames via unspecified vectors due to an information exposure vulnerability in forget passwd.cgi...
Asterisk Gather Credentials
This module retrieves SIP and IAX2 user extensions and credentials from Asterisk Call Manager service. Valid manager credentials are required. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...
D-Link DIR-600M Device Cross-Site Scripting Vulnerability
D-Link DIR-600M is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the 'username' parameter of the form2userconfig.cgi file in versions prior to C1v3.05ENB01beta20170306 of the D-Link DIR-600M device. A remote attacker can use this vulnerability to...