Qlik Community 信息泄露漏洞

Qlik Community is a data analytics solution. Qlik Community suffers from an information disclosure vulnerability that originates from allowing a remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authenticated requests to an affected system...

Generation of Error Message Containing Sensitive Information in Keycloak

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack...

CVE-2021-32732

Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which usernames is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those...

CVE-2021-32732

CVE-2021-32732 affects XWiki Platform and enables an attacker to determine whether an email address is linked to an account by forging requests to the Forgot Username page, exploiting a missing CSRF check. The root cause is CSRF protection absence on ForgotUsername, allowing enumeration of userna...

Vivellio 1.2.1 User Account Enumeration Vulnerability

Vivellio version 1.2.1 suffers from a user account enumeration vulnerability. User account enumeration in password reset function Overview Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2108-01 Affected product: Vivellio Android mobile application...

Vivellio 1.2.1 User Account Enumeration

Trovent Security Advisory 2108-01 User account enumeration in password reset function Overview Advisory ID: TRSA-2108-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2108-01 Affected product: Vivellio Android mobile application...

CVE-2021-38476

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts...

IR615 Router 安全漏洞

The IR615 Router is a 4G industrial router from Rimu Technologies, China. The IR615 Router has a security vulnerability that could be exploited by an attacker to enumerate different user accounts...

Apache Superset Account Enumeration Vulnerability

Apache Superset is an open source BI tool for data exploration and visual analysis. Apache Superset suffers from an account enumeration vulnerability that can be exploited by attackers with specially crafted requests to cause a denial of service...

Apache Superset 1.1.0 Account Enumeration

Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration Author: Dolev Farhi Date: 2021-05-13 Vendor Homepage: https://superset.apache.org/ Version: 1.1.0 Tested on: Ubuntu import sys import requests import time scheme = 'http' host = '192.168.1.1' port = 8080 change with your wordli...

Apache Superset 1.1.0 - Time-Based Account Enumeration Exploit

Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration Author: Dolev Farhi Vendor Homepage: https://superset.apache.org/ Version: 1.1.0 Tested on: Ubuntu import sys import requests import time scheme = 'http' host = '192.168.1.1' port = 8080 change with your wordlist usernames =...

Apache Superset 1.1.0 - Time-Based Account Enumeration

Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration Author: Dolev Farhi Date: 2021-05-13 Vendor Homepage: https://superset.apache.org/ Version: 1.1.0 Tested on: Ubuntu import sys import requests import time scheme = 'http' host = '192.168.1.1' port = 8080 change with your wordli...

PT-2021-18372 · Pypi · Flask-Appbuilder

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions 3.2.3 and earlier Description: The issue allows a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in. This is due to user enumeration in database...

CVE-2021-1486

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A...

CVE-2021-1486

A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to enumerate user accounts. This vulnerability is due to the improper handling of HTTP headers. An attacker could exploit this vulnerability by sending authenticated requests to an affected system. A...

CVE-2021-3391

MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message...

Design/Logic Flaw

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack...

CVE-2020-1717

A flaw was found in keycloak. An attacker could use the change email function in the account settings to determine if an email address was already used for another account an account enumeration attack. The highest threat from this flaw is to data confidentiality...

Zammad Account Enumeration Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An account enumeration vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited to guess valid user e-mail addresses via the "Create User" feature...

CVE-2020-26034

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as...