389 matches found
User account enumeration in Serenity
An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...
GHSA-W7JM-9X4M-8QC3 User account enumeration in Serenity
An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...
GHSA-89P3-9J8C-FQH4 Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...
CVE-2022-48366
CVE-2022-48366 affects eZ Platform Ibexa Kernel prior to 1.3.19, enabling an attacker to determine whether an account exists via a timing attack (remote, no auth, no user interaction). The CVSS v3.1 vector indicates network access, high attack complexity, and no privileges required, with a low co...
SUSE CVE-2013-2264
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition BE C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits...
SUSE CVE-2017-5537
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests...
CVE-2022-30332
In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of...
Talend Administration Center 授权问题漏洞
Talend Administration Center is a web-based application from Talend USA that centralizes studio management. A security vulnerability exists in Talend Administration Center 7.3.1.20200219 prior to TAC-15950. An attacker exploits the vulnerability to enumerate accounts through a series of requests...
PT-2023-13003 · Talend · Talend Administration Center
Name of the Vulnerable Software and Affected Versions: Talend Administration Center version 7.3.1.20200219 Description: The Forgot Password feature in the affected software provides different error messages for invalid reset attempts depending on whether the email address is associated with any...
CVE-2022-44381
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...
Grafana Account Enumeration Vulnerability
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a security vulnerability that stems from the fact that an attacker can bypass access...
CVE-2022-40292
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system...
PT-2022-25328 · Php Point Of Sale Llc +1 · Php Point Of Sale
Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue allows for unauthenticated user enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system. Recommendations: At the moment...
CVE-2021-36201
Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions...
Sensormatic Electronics C-CURE 9000 安全漏洞
Sensormatic Electronics C-CURE 9000 is an event security management system from Sensormatic Electronics. Monitor events and system activity, create reports, display dynamic views, view video, and manage people and guest applications anywhere in the world, directly from your PC. A security...
Sensormatic Electronics C-CURE 9000
1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. Equipment: C-CURE 9000 Vulnerability: Observable Response Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...
GHSA-683W-84M7-P8PW Plone User account enumeration via crafted URL
membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...
Plone User account enumeration via crafted URL
membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...