PlexTrac 安全漏洞

PlexTrac is a penetration test reporting and management platform from the US-based PlexTrac, Inc. A security vulnerability exists in PlexTrac platform versions prior to 1.28.0 that stems from a username enumeration that allows invalid login attempts via HTTP response time for users configured to...

CVE-2022-34174

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a user enumeration vulnerability that stems from an observable time difference between a valid user a...

PT-2022-22041 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.355 and earlier, LTS versions 2.332.3 and earlier Description: The issue is related to an observable timing discrepancy on the login form, which allows distinguishing between login attempts with an invalid username and logi...

Response Discrepancy

flaskappbuilder causes discrepancies in responses. Timing the response time from the server when you are logging in allows any user to enumerate existing accounts...

PYSEC-2022-24

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...

PYSEC-2021-90

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

Flask-AppBuilder安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A user enumeration vulnerability exists in Flask- appbuilder, which can be exploited by an attacker to allow an unauthenticated user to enumerate existing accounts by timing the server's response time at login...

CVE-2020-9389

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames...

CVE-2020-9389

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames...

CVE-2019-6195

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

CVE-2019-13599

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times...

PT-2019-13444 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.848 Description: The login process in the affected software allows attackers to determine whether a username is valid by comparing response times. This issue can potentially be exploited to gather information...

DEBIAN-CVE-2013-4434

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames...

CVE-2010-5107

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service connection-slot exhaustion by periodically making many new TCP connections...