CVE-2019-19806

The CVE-2019-19806 issue affects MFScripts YetiShare versions 3.5.2 through 4.5.3, where _account_forgot_password.ajax.php reveals whether an email address is configured for a given account name. This enables attacker-driven account enumeration via guessing email addresses. The connected document...

CVE-2019-19805

accountforgotpassword.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses...

CVE-2019-19805

Affected software: MFScripts YetiShare, versions 3.5.2 through 4.5.3. The vulnerability stems from a timing discrepancy in _account_forgot_password.ajax.php that reveals whether an email address is configured for a given account name, enabling an attacker to enumerate valid accounts by guessing e...

PT-2019-15967

Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.3 Description The issue allows an attacker to enumerate accounts by guessing email addresses, as the account forgot password.ajax.php file displays a message indicating whether an email address is...

PT-2019-15966

Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.3 Description The issue allows an attacker to enumerate accounts by guessing email addresses due to a timing difference in the response of the account forgot password.ajax.php file. This timing...

CVE-2019-19806: Generation of Error Message Containing Sensitive Information

accountforgotpassword.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses...

CVE-2019-19805: Observable Discrepancy

accountforgotpassword.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses...

Design/Logic Flaw

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The CVE-2019-16669 issue concerns Pagekit 1.0.17, where Reset Password returns responses that differ depending on whether the entered e‑mail matches a valid user. This behavior enables user enumeration (information disclosure) by attackers, as described across multiple sources (CVE records, Red H...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669: Observable Discrepancy

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

PT-2019-14753

Name of the Vulnerable Software and Affected Versions Pagekit version 1.0.17 Description The issue concerns the Reset Password feature, which provides different responses based on whether a valid user account's email address is entered. This difference in response might facilitate account...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

Design/Logic Flaw

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

CVE-2019-1020013 affects parse-server prior to 3.6.0, allowing unauthenticated users to enumerate existing accounts via error messages. The root cause is information disclosure during authentication/account linking flow, where specific errors reveal account existence (ParseError.ACCOUNT_ALREADY_L...

CVE-2019-1020013: Generation of Error Message Containing Sensitive Information

parse-server before 3.6.0 allows account enumeration...

Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...