CVE-2011-2536

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...

CVE-2011-2666

The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the...

Sun Java System Identity Manager Account Disclosure

The version of Sun Java System Identity Manager running on the remote host has the following account enumeration vulnerabilities : - The error message for a failed login attempt is different, depending on whether or not a valid username was given. - Requesting...

Asterisk user account enumeration

Different replies for invalid username and password in IAX2 authentication...

WebCalendar User Account Enumeration Disclosure Issue

The remote web server is affected by an information disclosure issue. Description: The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the...

WebCalendar < 1.0.4 User Account Enumeration Disclosure Vulnerability - Active Check

The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid. SPDX-FileCopyrightText: 2008 David Maciejak Some text descriptio...

Microsoft Windows Active Directory users account enumeration

It's possible to enumerate accounts with Logon Hours limitation set...

Design/Logic Flaw

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

PT-2007-4082

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description The issue allows remote attackers to determine the existence of certain user accounts. This is possible when OpenSSH is using OPIE One-Time Passwords in Everything for PAM. The system display...

[Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used

Note to the Moderator: Sorry I send ya a Beta in the first mail : / / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author: Rembrandt Date: Known since somewhere ...

OpenSSH account enumeration

S/Key is requested only for existing user account, if S/Key authentication is used...

RCBlog index.php post Parameter Traversal Arbitrary File Access

The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magicquotes' setting is...

Inicom networks ioFTPd FTP Server account enumeration

Error messages differ for existant and non-existant user account...

Critical Security Advisory #005: ioFTPd User account enumeration vulnerability

Inicom networks ioFTPd 0.5.84u User account enumeration vulnerability Critical Security research: http://www.critical.lt Original Advisory may be found: http://www.critical.lt/?vulnerabilities/119 Vulnerable product: ioFTPd 0.5.84u maybe prior versions affected too Vulnerability type: User accoun...

Microsoft Outlook Web Access (OWA) owalogon.asp Redirection Account Enumeration

The remote host is running Microsoft Outlook Web Access OWA 2003. Due to a lack of sanitization of the user input, the remote version of this software is vulnerable to URL injection that can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. This...

ArGoSoft FTP Server USER Command Account Enumeration

The remote host is running the ArGoSoft FTP Server. The remote version of this software returns different error messages when a user attempts to log in using a nonexistent username or a bad password. An attacker may exploit this flaw to launch a dictionary attack against the remote host in order ...

Intellipeer User Account Enumeration

Binary data 2332.prm...

Intellipeer POP3 Server User Account Enumeration

The remote POP3 server probably intellipeer pop3 server is vulnerable to an account enumeration issue. If an attacker attempts to log into the remote host by submitting a bogus username, then the server will reply with a specific error message if the account is nonexistent, while it will reply wi...

Netscape Messenging Server User Account Enumeration

Binary data 1788.prm...

Kerio MailServer 5.6.3 Remote Buffer Overflow Exploit

Exploit for linux platform in category remote exploits ===================================================== Kerio MailServer 5.6.3 Remote Buffer Overflow Exploit ===================================================== / Remote Buffer Overflow Exploit for Kerio MailServer 5.6.3 / /...