PT-2023-32709 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1 Description: The issue is related to an API endpoint missing an authentication mechanism, allowing an unauthenticated attacker to enumerate ancillary credential information stored within the software...

SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.

Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but d...

Information Exposure

Umbraco is vulnerable to Information Exposure/User Enumeration. The vulnerability is due to PostRequestPasswordReset function in AuthenticationController.cs not have a feature to randomize the response time when processing password reset requests. This allows an attacker to potentially use the...

Anveo Mobile User Enumeration / Missing Certificate Validation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Missing Certificate Validation & User Enumeration product: Anveo Mobile App and Server vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5 fixed...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to improper configuration of the SMTP settings combined with enabled password reset functionality. An attacker can enumerate user accounts by observing the behavior of the password reset feature. Remediation...

CVE-2023-49274

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

Default credentials

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

CVE-2023-49274

Umbraco CMS: A user enumeration vulnerability exists due to SMTP misconfiguration when password reset is enabled, affecting versions before 8.18.10, 10.8.1, and 12.3.4. Affected component is the password reset flow; the underlying issue is how SMTP configuration interacts with reset-password resp...

CVE-2023-49274 Umbraco CMS SMTP misconfiguration exposes potential registered user email

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

CVE-2023-49274 Umbraco CMS SMTP misconfiguration exposes potential registered user email

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

Umbraco Information Disclosure Vulnerability

Umbraco is an open source Content Management System CMS written in C by Umbraco, Denmark. Umbraco suffers from an information disclosure vulnerability that stems from a user enumeration attack that can occur when SMTP settings are incorrect but reset passwords are enabled...

AcuAutomate - Unofficial Acunetix CLI Tool For Automated Pentesting And Bug Hunting Across Large Scopes

AcuAutomate is an unofficial Acunetix CLI tool that simplifies automated pentesting and bug hunting across extensive targets. It's a valuable aid during large-scale pentests, enabling the easy launch or stoppage of multiple Acunetix scans simultaneously. Additionally, its versatile functionality...

Information Disclosure

code.gitea.io/gitea, codeberg.org/forgejo/forgejo is vulnerable to Information Disclosure. The vulnerability is due to the UsernameSubRoute function in home.go because there are no view permissions checks. The server's response can reveal information about the existence of a private user account,...

CVE-2023-5635 User Enumeration in ArslanSoft's Education Portal

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects Education Portal: before v1.1...

CVE-2023-5635 User Enumeration in ArslanSoft's Education Portal

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects Education Portal: before v1.1...

CVE-2023-6344

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable...

CVE-2023-6352

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

CVE-2023-6352

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

Default configuration

Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx 'ifolder' parameter. This behavior is related to the use of a deprecated version of Aquaforest TIFF Server, possibly 2.x. The vulnerable...

CVE-2023-6352 Aquaforest TIFF Server default configuration allows access to arbitrary files

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...