CVE-2015-0597: Improper Input Validation

The Forgot Password feature in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159...

SMB Account Enumeration

Binary data 7166.pasl...

CVE-2014-8035

The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247...

PT-2015-3997

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server affected versions not specified Description The issue concerns the web framework in Cisco WebEx Meetings Server, which returns different messages for URL requests based on whether a username exists. This allows remo...

PT-2014-8372

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager IM and Presence Service version 9.11 Description The issue allows remote attackers to enumerate user accounts via a series of URL requests, as different returned messages are produced depending on whether a...

CVE-2014-8000: Undefined Security Weakness

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

PYSEC-2014-39

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

Code injection

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

CVE-2012-5497: Exposure of Sensitive Information to an Unauthorized Actor

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

Design/Logic Flaw

The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate accoun...

CVE-2014-3105

CVE-2014-3105 affects IBM Rational ClearQuest Web OSLC integration and enables credential enumeration via distinct login error messages. IBM’s advisory lists affected versions: 7.1.0.x/7.1.1.x (all), 7.1.2.x (up to 7.1.2.14), 8.0.0.x (up to 8.0.0.11), and 8.0.1.x (up to 8.0.1.4). The root cause i...

CVE-2014-3105: Exposure of Sensitive Information to an Unauthorized Actor

The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate accoun...

PT-2014-5094

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1 through 7.1.2.14 IBM Rational ClearQuest versions 8.0.0 through 8.0.0.11 IBM Rational ClearQuest versions 8.0.1 through 8.0.1.4 Description The OSLC integration feature in the Web component provides differe...

(Plone): Anonymous users can list user account names

It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names...

Cross site request forgery (csrf)

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

CVE-2014-5137

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

CVE-2014-5137: Exposure of Sensitive Information to an Unauthorized Actor

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

PT-2014-6300

Name of the Vulnerable Software and Affected Versions Innovative Interfaces Sierra Library Services Platform version 1.2 3 Description The issue allows remote attackers to enumerate account names via a series of login requests. This is possibly related to the Webpac Pro submodule, where different...

PT-2014-5199

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server affected versions not specified Description The issue allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages. Recommendations At the moment, there is no...