WebCalendar User Account Enumeration Disclosure Issue

The remote web server is affected by an information disclosure issue. Description: The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the...

WebCalendar < 1.0.4 User Account Enumeration Disclosure Vulnerability - Active Check

The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid. SPDX-FileCopyrightText: 2008 David Maciejak Some text descriptio...

CVE-2007-2999: Undefined Security Weakness

Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...

Microsoft Windows Active Directory users account enumeration

It's possible to enumerate accounts with Logon Hours limitation set...

Design/Logic Flaw

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2768: Exposure of Sensitive Information to an Unauthorized Actor

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

PT-2007-4082

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description The issue allows remote attackers to determine the existence of certain user accounts. This is possible when OpenSSH is using OPIE One-Time Passwords in Everything for PAM. The system display...

[Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used

Note to the Moderator: Sorry I send ya a Beta in the first mail : / / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author: Rembrandt Date: Known since somewhere ...

OpenSSH account enumeration

S/Key is requested only for existing user account, if S/Key authentication is used...

CVE-2007-0310: Undefined Security Weakness

BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names...

CVE-2007-0195: Undefined Security Weakness

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account...

RCBlog index.php post Parameter Traversal Arbitrary File Access

The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magicquotes' setting is...

Critical Security Advisory #005: ioFTPd User account enumeration vulnerability

Inicom networks ioFTPd 0.5.84u User account enumeration vulnerability Critical Security research: http://www.critical.lt Original Advisory may be found: http://www.critical.lt/?vulnerabilities/119 Vulnerable product: ioFTPd 0.5.84u maybe prior versions affected too Vulnerability type: User accoun...

Inicom networks ioFTPd FTP Server account enumeration

Error messages differ for existant and non-existant user account...

CVE-2001-1483: Observable Discrepancy

One-Time Passwords In Everything a.k.a OPIE 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist...

Microsoft Outlook Web Access (OWA) owalogon.asp Redirection Account Enumeration

The remote host is running Microsoft Outlook Web Access OWA 2003. Due to a lack of sanitization of the user input, the remote version of this software is vulnerable to URL injection that can be exploited to redirect a user to a different, unauthorized web server after authenticating to OWA. This...

ArGoSoft FTP Server USER Command Account Enumeration

The remote host is running the ArGoSoft FTP Server. The remote version of this software returns different error messages when a user attempts to log in using a nonexistent username or a bad password. An attacker may exploit this flaw to launch a dictionary attack against the remote host in order ...

Intellipeer User Account Enumeration

Binary data 2332.prm...

Intellipeer POP3 Server User Account Enumeration

The remote POP3 server probably intellipeer pop3 server is vulnerable to an account enumeration issue. If an attacker attempts to log into the remote host by submitting a bogus username, then the server will reply with a specific error message if the account is nonexistent, while it will reply wi...

CVE-2001-1302: Undefined Security Weakness

The change password option in the Windows Security interface for Windows 2000 allows attackers to use the option to attempt to change passwords of other users on other systems or identify valid accounts by monitoring error messages, possibly due to a problem in the NetuserChangePassword function...