GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...

PT-2019-11629

Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.6.0 Description: The issue allows for account enumeration. An attacker can guess ids and obtain information about linked accounts or email addresses. This occurs because ParseError.ACCOUNT ALREADY LINKED208 is...

Authentication flaw

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...

CVE-2018-15131

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...

CVE-2018-15131

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests...

CVE-2018-15131

CVE-2018-15131 affects Synacor Zimbra Collaboration Suite: versions 8.6.x prior to 8.6.0 Patch 11, 8.7.x prior to 8.7.11 Patch 6, 8.8.x prior to 8.8.8 Patch 9, and 8.8.9 prior to 8.8.9 Patch 3. are vulnerable to account number enumeration due to inconsistent responses for certain authentication r...

Code injection

CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names...

CVE-2018-14597

The CVE-2018-14597 entry involves CA Technologies Identity Governance components: Identity Governance versions 12.6, 14.0, 14.1, and 14.2, and CA Identity Suite Virtual Appliance versions 14.0–14.2. The issue stems from verbose error messages that may allow remote attackers to enumerate account n...

PT-2018-12605

Name of the Vulnerable Software and Affected Versions CA Technologies Identity Governance versions 12.6, 14.0, 14.1, and 14.2 CA Identity Suite Virtual Appliance versions 14.0, 14.1, and 14.2 Description The issue allows remote attackers to enumerate account names due to telling error messages...

CVE-2018-14597: Observable Discrepancy

CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names...

ASUSTOR Data Master Account Enumeration Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A security vulnerability exists in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker can exploit this vulnerability to enumerate all accounts on the device with the help of the user.cgi...

ASUSTOR ADM < 3.1.6 Multiple Vulnerabilities

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

Code injection

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi...

PT-2018-13148

Name of the Vulnerable Software and Affected Versions ASUSTOR Data Master versions 3.1.5 and below Description The issue allows authenticated remote non-administrative users to enumerate all user accounts via the user.cgi endpoint. Recommendations For ASUSTOR Data Master versions 3.1.5 and below,...

CVE-2018-15696: Exposure of Sensitive Information to an Unauthorized Actor

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi...

ASUSTOR Data Master < 3.1.6 Multiple Vulnerabilities

According to its self-reported version number, the ASUSTOR Data Master ADM web interface running on the remote web server is prior to 3.1.6. It is, therefore, affected by multiple vulnerabilities: - CVE-2018-15694: Authenticated File Upload - CVE-2018-15695: Authenticated Arbitrary File Deletion ...

PT-2018-5089

Name of the Vulnerable Software and Affected Versions Accellion FTP server versions prior to FTA 9 12 220 Description The issue allows an attacker to determine valid user accounts by enumerating them, as the server only returns the username in the response if the username is invalid...

ovirt-engine: account enumeration through login to web console

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...

CVE-2018-10949

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...

CVE-2018-10949

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors...