635 matches found
Sun Java System Identity Manager Account Disclosure
The version of Sun Java System Identity Manager running on the remote host has the following account enumeration vulnerabilities : - The error message for a failed login attempt is different, depending on whether or not a valid username was given. - Requesting...
Asterisk user account enumeration
Different replies for invalid username and password in IAX2 authentication...
WebCalendar User Account Enumeration Disclosure Issue
The remote web server is affected by an information disclosure issue. Description: The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the...
WebCalendar < 1.0.4 User Account Enumeration Disclosure Vulnerability - Active Check
The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid. SPDX-FileCopyrightText: 2008 David Maciejak Some text descriptio...
CVE-2007-2999: Undefined Security Weakness
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...
Microsoft Windows Active Directory users account enumeration
It's possible to enumerate accounts with Logon Hours limitation set...
Design/Logic Flaw
OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...
CVE-2007-2768: Exposure of Sensitive Information to an Unauthorized Actor
OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...
PT-2007-4082
Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description The issue allows remote attackers to determine the existence of certain user accounts. This is possible when OpenSSH is using OPIE One-Time Passwords in Everything for PAM. The system display...
OpenSSH account enumeration
S/Key is requested only for existing user account, if S/Key authentication is used...
[Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used
Note to the Moderator: Sorry I send ya a Beta in the first mail : / / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author: Rembrandt Date: Known since somewhere ...
CVE-2007-0310: Undefined Security Weakness
BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names...
CVE-2007-0195: Undefined Security Weakness
my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account...
RCBlog index.php post Parameter Traversal Arbitrary File Access
The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magicquotes' setting is...
Critical Security Advisory #005: ioFTPd User account enumeration vulnerability
Inicom networks ioFTPd 0.5.84u User account enumeration vulnerability Critical Security research: http://www.critical.lt Original Advisory may be found: http://www.critical.lt/?vulnerabilities/119 Vulnerable product: ioFTPd 0.5.84u maybe prior versions affected too Vulnerability type: User accoun...
Inicom networks ioFTPd FTP Server account enumeration
Error messages differ for existant and non-existant user account...
CVE-2001-1483: Observable Discrepancy
One-Time Passwords In Everything a.k.a OPIE 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist...
Microsoft Outlook Web Access (OWA) owalogon.asp Redirection Account Enumeration
The remote host is running Microsoft Outlook Web Access OWA 2003. Due to a lack of sanitization of the user input, the remote version of this software is vulnerable to URL injection that can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. This...
ArGoSoft FTP Server USER Command Account Enumeration
The remote host is running the ArGoSoft FTP Server. The remote version of this software returns different error messages when a user attempts to log in using a nonexistent username or a bad password. An attacker may exploit this flaw to launch a dictionary attack against the remote host in order ...