CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

Orangehrm 安全漏洞

Orangehrm is a human resource management system HRM from Orangehrm, USA. The system supports personnel information management, leave management, attendance management and recruitment management. An information disclosure vulnerability exists in OrangeHRM version 4.7 that could allow an...

CVE-2020-1717

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack...

CVE-2020-1717

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack...

CVE-2020-1717

Keycloak 7.0.1 contains an account email enumeration issue where a logged-in user can determine whether an email is associated with an existing account. The CVE entry notes a low overall CVSS v3.1 base score (2.7) with Confidentiality impact as the primary concern; Privileges Required is High, an...

CVE-2020-1717

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack...

Keycloak security vulnerability

A security vulnerability exists in Keycloak 7.0.1 that originates from an account email enumeration attack by a logged in user...

Rocket.Chat: Hi! Security Team Rocket.Chat, It's possible to get information about the users emails without authentication

Description: Email enumeration vulnerability. Vulnerable api method: /api/v1/users.2fa.sendEmailCode Releases Affected:: Rocket.Chat up to 3.10.5 Request for existing account: POST /api/v1/users.2fa.sendEmailCode HTTP/1.1 Host: rocket-chat.local:3000 Referer: http://rocket-chat.local:3000/home...

Design/Logic Flaw

An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...

CVE-2020-28208

An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...

Rocket.Chat 3.7.1 Email Address Enumeration

Trovent Security Advisory 2010-01 Email address enumeration in reset password Overview Advisory ID: TRSA-2010-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2010-01 Affected product: Web application Rocket.Chat Affected version: = 3.7.1 Vendor:...

Brave Software: No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.org

There is no bruteforce protection here https://publishers.basicattentiontoken.org/publishers when i try to changes email's contact account. Also the actual thing is when I put an existing email in the above url's "publisherpendingemail" parameter I get an error response status 400 Bad Request But...

Mellow Fish YetiShare Information Disclosure Vulnerability

Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A security vulnerability exists in the accountforgotpassword.ajax.php file in Mellow Fish YetiShare versions 3.5.2 through 4.5.3. An attacker can exploit the vulnerability to enumerate user accounts by guessi...

Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration

The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...

CVE-2019-6120

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

DEBIAN-CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

Omise: Email enumeration at SignUp page

Hi. There's bad security practise at https://trade.go.exchange/en/auth/sign-up against User enumeration. Description: At the signup page here https://trade.go.exchange/en/auth/sign-up , when you enter an existing user's mail , a msg box says "Email is invalid." F546294 The problem is that any use...

Revive Adserver: Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:

Hi, This is a fun bug I came across while doing a pentest for a client, after going through Revive Advserver's code for a few hours, I found this authentication bypass. This vulnerability seem to affect all versions, including the latest one, I was sent by one of your developers to report it here...

Exchange email enumeration

Error-based user enumeration for Office 365 integrated email addresses Module Options msf use auxiliary/scanner/msmail/exchange/enum msf undefinedenum show actions ...actions... msf undefinedenum set ACTION msf undefinedenum show options ...show and set options... msf undefinedenum run...

CVE-2018-1000549

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request...