Shopware has user enumeration via distinct error codes on Store API login endpoint

Summary The Store API login endpoint POST /store-api/account/login returns different error codes depending on whether the submitted email address belongs to a registered customer CHECKOUTCUSTOMERAUTHBADCREDENTIALS or is unknown CHECKOUTCUSTOMERNOTFOUND. The "not found" response also echoes the...

Rucio WebUI has Username Enumeration via Login Error Message

Summary The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Details When submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on th...

CVE-2020-36888 SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script

SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing...

CVE-2025-65899

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...

CVE-2025-40760

Affected product: Altair Grid Engine before 2026.0.0. Root cause: error handling mishandling during user authentication leads to disclosure of password hashes of privileged accounts. Impact: local attacker could recover password hashes for offline brute-forcing. Evidence across connected sources ...

The vulnerability of the ProFTPD FTP server, related to errors in the authentication process, allows attackers to manipulate data.

The vulnerability of the ProFTPD FTP server is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2025-34155

Tibbo AggreGate Network Manager 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the login process. An attacker can determine the existence of user accounts by analyzing differences in error messages presented during authentication attempts. Remediation Upgrade ibexa/user to version 5.0.3 or...

The vulnerability of the universal monitoring system Zabbix, related to authentication errors, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Zabbix universal monitoring system is related to authentication errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

EUVD-2014-8150

Malware in sbrugna...

EUVD-2015-3708

Malware in sbrugna...

CVE-2025-55068

Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial-of-service condition...

CVE-2025-55068

Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial-of-service condition...

CVE-2025-55068 Dover Fueling Solutions ProGauge MagLink LX4 Devices Integer Overflow or Wraparound

Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial-of-service condition...

CVE-2025-55068 Dover Fueling Solutions ProGauge MagLink LX4 Devices Integer Overflow or Wraparound

Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial-of-service condition...

USN-7705-1 tomcat10 vulnerabilities

It was discovered that Tomcat did not correctly handle case sensitivity. An attacker could possibly use this issue to bypass authentication mechanisms. CVE-2025-46701 Elysee Franchuk discovered that Tomcat did not correctly limit the number of attributes for a session. An attacker could possibly...

The vulnerability of cross-platform software for protecting network connections, related to errors in the certificate validation process, allows attackers to circumvent security restrictions.

The vulnerability of cross-platform software for protecting Tunneling Protocol network connections is related to errors in the authentication process. Exploiting this vulnerability can allow an attacker to circumvent security restrictions remotely...

The vulnerability of the Managed Configuration component for macOS operating systems allows attackers to increase their privileges.

The vulnerability of the Managed Configuration component for macOS operating systems is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the MFlash secure data exchange platform, related to authentication errors, allows attackers to escalate their privileges.

The vulnerability of the MFlash secure data exchange platform is related to authentication errors. Exploiting this vulnerability allows a malicious actor to enhance their privileges and use the file storage system beyond the architectural limitations by intercepting API responses...

The vulnerability of Zoom’s video conferencing software, related to errors in the authentication process, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Zoom’s video conferencing software is related to errors in the authentication process for verifying certificate authenticity. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...