11709 matches found
GO-2022-0704 Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) in github.com/goharbor/harbor
Unauthenticated users can exploit an enumeration vulnerability in Harbor CVE-2019-19030 in github.com/goharbor/harbor...
PT-2024-7392
Name of the Vulnerable Software and Affected Versions: Webmin Usermin version 2.100 Description: A discrepancy in error messages for invalid login attempts in Webmin Usermin allows attackers to enumerate valid user accounts. This issue is related to shortcomings in the error reporting mechanism,...
GO-2023-1986 HashiCorp Vault and Vault Enterprise vulnerable to user enumeration in github.com/hashicorp/vault
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration in github.com/hashicorp/vault...
GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd
Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd...
Security update for python-Django (important)
openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2024:0251-1 Rating: important References: 1207565 1227590 1227593 1227594 1227595 Cross-References: CVE-2023-23969 CVE-2024-38875 CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVSS scores: CVE-2023-23969 NVD :...
OESA-2024-2003 python-django security update
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with ...
OESA-2024-2002 python-django security update
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumera...
OESA-2024-2004 python-django security update
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with ...
First logon of the day for any user takes extra time to enumerate resources
First logon of the day for any user takes extra time to enumerate the Applications\Desktop. Subsequent logon for the same user is quick...
Exploit for Observable Discrepancy in 42Gears Suremdm
CVE-2023-3897 Username enumeration is possible through Bypassi...
CVE-2024-41737
SAP CRM ABAP Insights Management allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application...
CVE-2024-41737 Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)
SAP CRM ABAP Insights Management allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application...
CVE-2024-41737 Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)
SAP CRM ABAP Insights Management allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application...
CVE-2024-7266
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17...
Mettler Toledo IND780 Weighing Terminal Remote Unauthenticated Directory Traversal (CVE-2021-40661)
A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 SS Label 'IND7808.0.07', Version 7.2.10 June 18, 2012 SS Label 'IND7807.2.10'. It was possible to traverse the folders of the...
Windows System Driver Enumeration (Windows)
Binary data wmienumkerneldrivers.nbin...
CVE-2024-41952 Zitadel has an "Ignoring unknown usernames" vulnerability
Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...
CVE-2024-41952 Zitadel has an "Ignoring unknown usernames" vulnerability
Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...
CVE-2024-41952
The Zitadel CVE-2024-41952 issue concerns the handling of the "Ignoring unknown usernames" flag. When enabled, Zitadel would show a password prompt even for non-existent users and surface a non-generic error path; due to a database deadlock workaround, some cases could reveal that an account exis...