Adenza AxiomSL 安全漏洞

Adenza AxiomSL is a risk and regulatory reporting platform from Adenza USA. A security vulnerability exists in Adenza AxiomSL ControllerView that allows an attacker to recognize a valid username on the platform, as failed login attempts generate a different error message when the username is vali...

Mageia: Security Advisory (MGASA-2021-0304)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-22789

Charactell - FormStorm Enterprise Account takeover – An attacker can modify add, remove and update passwords file for all the users. The xxusers.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existi...

CVE-2022-22789

Charactell - FormStorm Enterprise Account takeover – An attacker can modify add, remove and update passwords file for all the users. The xxusers.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existi...

Design/Logic Flaw

Charactell - FormStorm Enterprise Account takeover – An attacker can modify add, remove and update passwords file for all the users. The xxusers.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existi...

CVE-2022-22789 Charactell - FormStorm Enterprise Account Take Over

Charactell - FormStorm Enterprise Account takeover – An attacker can modify add, remove and update passwords file for all the users. The xxusers.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existi...

CVE-2021-25037

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed...

CVE-2021-25037

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed...

CVE-2021-25037

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed...

Sql injection

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed...

WordPress plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the All in...

Unspecified Vulnerability in Netgear RAX43

The Netgear RAX43 is a wireless router from Netgear USA. A security vulnerability exists in the Netgear RAX43 that stems from storing sensitive information in plaintext. All usernames and passwords for device-related services are stored on the device in plaintext. No details of the vulnerability...

Trendnet AC2600 安全漏洞

Trendnet AC2600 TEW-827DRU is a wireless router.The Trendnet AC2600 TEW-827DRU has a security vulnerability that could be exploited by an attacker to store user names and passwords in plaintext in the device's configuration file...

CVE-2020-35398

CVE-2020-35398 affects the UTI Mutual fund Android app (versions 5.4.18 and earlier). The issue allows brute-forcing username enumeration via the error message shown after invalid credentials, enabling attackers to identify valid usernames. Documents consistently describe the vulnerability as an ...

CVE-2020-35398

An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted...

CVE-2021-44554

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS Windows through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to...

GHSA-9C5C-5J4H-8Q2C BookStack is vulnerable to Improper Access Control.

BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user if public access enabled can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database...

VulnCheck KEV: CVE-2021-25037

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and...

Security Bulletin: Novalink Vulnerability to allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. (CVE-2021-29842)

Summary Novalink uses WebSphere Application Server Liberty. Which could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 a...

CVE-2021-44155

An issue was discovered in /goform/loginprocess in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users...