633 matches found
CVE-2016-4745: Exposure of Sensitive Information to an Unauthorized Actor
The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...
CVE-2016-5797
Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts...
CVE-2016-5797
CVE-2016-5797 affects Tollgrade LightHouse SMS Software prior to Version 5.1 Patch 3. The issue is information exposure through error messages that reveal whether a username exists, enabling remote account-name enumeration. Affected component is the web-based LightHouse SMS software; the root cau...
PT-2016-6685
Name of the Vulnerable Software and Affected Versions Tollgrade LightHouse SMS versions prior to 5.1 patch 3 Description The issue allows remote attackers to enumerate account names via a series of authentication attempts, due to different error messages being provided for failed authentication...
CVE-2016-5797: Exposure of Sensitive Information to an Unauthorized Actor
Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts...
DNS Analysis Tool: Bluto
The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto will attempt to identify if SubDomain Wild Cards are being used. If they a...
CVE-2016-3649
Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...
PT-2016-5635
Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager versions 12.1 through 12.1 before RU6 MP5 Description The issue allows remote authenticated administrators to enumerate administrator accounts by sending modified GET requests. This could potentially be use...
Cisco WebEx Meeting Center User Account Enumeration Vulnerability
Cisco WebEx Meeting Center is a set of WebEx meeting solutions in the United States Cisco Cisco company's network of online meeting products. The product invites others to join the meeting via e-mail or instant messaging IM, and supports online product demonstrations, information sharing, and mor...
Amazon Linux AMI : pam (ALAS-2015-589)
It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user accounts, or cause a...
Medium: pam
Issue Overview: It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user...
CVE-2015-4194: Exposure of Sensitive Information to an Unauthorized Actor
The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive informati...
PT-2015-6451
Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Center affected versions not specified Description The issue concerns the web-based administrative interface, which provides different error messages for failed login attempts. This allows remote attackers to enumerate...
Legal Robot: - Guessing registered users in legalrobot.com
Security researcher described a method to enumerate emails from the password reset page using brute force techniques. The response messages allowed a user to determine if an account existed. Furthermore, no rate limiting was applied...
CVE-2015-2762: Exposure of Sensitive Information to an Unauthorized Actor
Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...
Persistent Systems Radia Client Automation Remote Elevation of Privilege Vulnerability
Persistent Systems Radia Client Automation is a solution with superior manageability designed specifically for particularly complex and ever-changing enterprise client infrastructures. Persistent Systems Radia Client Automation fails to properly restrict access to certain requests, allowing remot...
CVE-2015-1498: Undefined Security Weakness
Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...
PT-2015-1316
Name of the Vulnerable Software and Affected Versions Persistent Systems Radia Client Automation affected versions not specified Description The issue is related to insufficient access restrictions in certain requests, allowing remote attackers to enumerate user accounts via a "getUsers" request,...
PT-2015-4741
Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server version 1.5.1.131 and earlier Description The issue concerns the Forgot Password feature, which allows remote attackers to enumerate administrative accounts via crafted packets. Recommendations For Cisco WebEx...
CVE-2015-0597: Improper Input Validation
The Forgot Password feature in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159...