CVE-2016-5797

CVE-2016-5797 affects Tollgrade LightHouse SMS Software prior to Version 5.1 Patch 3. The issue is information exposure through error messages that reveal whether a username exists, enabling remote account-name enumeration. Affected component is the web-based LightHouse SMS software; the root cau...

DNS Analysis Tool: Bluto

The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto will attempt to identify if SubDomain Wild Cards are being used. If they a...

CVE-2016-3649

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...

Cisco WebEx Meeting Center User Account Enumeration Vulnerability

Cisco WebEx Meeting Center is a set of WebEx meeting solutions in the United States Cisco Cisco company's network of online meeting products. The product invites others to join the meeting via e-mail or instant messaging IM, and supports online product demonstrations, information sharing, and mor...

Amazon Linux AMI : pam (ALAS-2015-589)

It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user accounts, or cause a...

Medium: pam

Issue Overview: It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user...

Legal Robot: - Guessing registered users in legalrobot.com

Security researcher described a method to enumerate emails from the password reset page using brute force techniques. The response messages allowed a user to determine if an account existed. Furthermore, no rate limiting was applied...

Persistent Systems Radia Client Automation Remote Elevation of Privilege Vulnerability

Persistent Systems Radia Client Automation is a solution with superior manageability designed specifically for particularly complex and ever-changing enterprise client infrastructures. Persistent Systems Radia Client Automation fails to properly restrict access to certain requests, allowing remot...

SMB Account Enumeration

Binary data 7166.pasl...

CVE-2014-8035

The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247...

PYSEC-2014-39

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

Code injection

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

Design/Logic Flaw

The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate accoun...

CVE-2014-3105

CVE-2014-3105 affects IBM Rational ClearQuest Web OSLC integration and enables credential enumeration via distinct login error messages. IBM’s advisory lists affected versions: 7.1.0.x/7.1.1.x (all), 7.1.2.x (up to 7.1.2.14), 8.0.0.x (up to 8.0.0.11), and 8.0.1.x (up to 8.0.1.4). The root cause i...

(Plone): Anonymous users can list user account names

It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names...

Cross site request forgery (csrf)

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

CVE-2014-5137

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

Cerberus FTP Server 6.x < 6.0.9.0 / 7.x < 7.0.0.2 SSH FTP Account Enumeration

The version of Cerberus FTP Server on the remote host is version 6.x prior to 6.0.9.0 or version 7.x prior to 7.0.0.2. It is, therefore, affected by an unauthorized information disclosure vulnerability. A remote attacker can enumerate user accounts via an analysis of responses from the SSH FTP...

Improper access control

The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager CDM 9.0.1 and earlier does not properly implement access control, which allows remote attackers to enumerate account names via a crafted URL, aka Bug IDs CSCun39631 and CSCun39643...