138 matches found
CVE-2023-30458
Summary: Medicine Tracker System 1.0 suffers a username enumeration in its login function: valid usernames leak via longer response times tied to password length. Impact: potential credential discovery over network with no direct exploitation details in the provided documents. Remediation (suppor...
PT-2023-8558
Name of the Vulnerable Software and Affected Versions SourceCodester Simple Customer Relationship Management System version 1.0 Description The issue is related to the lack of protection against SQL query structure attacks in the php-scrm/login.php component of the Simple Customer Relationship...
Siemens Desigo PXC and DXR Devices Improper Restriction of Excessive Authentication Attempts (CVE-2022-24044)
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application does not employ any countermeasures...
CVE-2022-41697: Observable Response Discrepancy
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability...
Design/Logic Flaw
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively we can see the...
WS-2022-0450
User Enumeration via Response Timing was discovered in heroiclabs/nakama through 3.15.0. There is a significant timing difference in the login functionality of the Nakama Console for valid and invalid email addresses or usernames. An attacker is able to identify valid email addresses and username...
CVE-2022-32282
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
Input validation
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
CVE-2022-32282
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
CVE-2022-32282
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
CVE-2022-32282
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...
PT-2022-18838 · Sourcecodester · Sourcecodester Simple/Nice Shopping Cart Script
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple and Nice Shopping Cart Script affected versions not specified Description: A vulnerability has been found in the software, affecting an unknown functionality of the file /mkshope/login.php. The issue is related to the...
CVE-2022-34530
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames...
CVE-2022-24044
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application does not employ any countermeasures...
Design/Logic Flaw
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application does not employ any countermeasures...
CVE-2022-24044
The CVE-2022-24044 entry affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5 controllers. Root cause: the login functionality lacks protection against Password Spraying/Credential Stuffing, enabling an attacker to enumerate valid usernames and then perform targeted login attempts to gain access to a...
PT-2022-15387
Name of the Vulnerable Software and Affected Versions IBM MQ Appliance versions 9.2 CD and 9.2 LTS Description The issue allows an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. Recommendations For IBM MQ Appliance versions 9.2 CD a...
PT-2021-23317
Name of the Vulnerable Software and Affected Versions Lodging Reservation Management System version V1 Description The issue allows unauthorized access to any user by exploiting SQL injection in the username and password fields of the login functionality. This enables bypassing authentication,...