Apache Sling Framework v2.3.6 - Information Disclosure

Document Title: =============== Apache Sling Framework v2.3.6 - Information Disclosure References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1536 Adobe Bulletin: https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html Vulnerability Magazine...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

MySQL Protocol Remote User Enumeration

The version of MySQL or MariaDB running on the remote host has a user enumeration vulnerability. A remote, unauthenticated attacker could exploit this to learn the names of valid database users. This information could be used to mount further attacks. C Tenable Network Security, Inc...

UBUNTU-CVE-2012-5615

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

CVE-2011-4894

CVE-2011-4894 affects Tor prior to 0.2.2.34 when run as a bridge. The issue is that DirPort connections are used directly for directory fetches instead of a Tor TLS connection, which can enable remote observers to enumerate bridges by monitoring DirPort activity. The available connected documents...

CVE-2011-4895: Exposure of Sensitive Information to an Unauthorized Actor

Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building...

MySQL Enumeration Module

This module allows for simple enumeration of MySQL Database Server provided proper credentials to connect remotely. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MySQL Enumeration Module',...

DEBIAN-CVE-2009-2335

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...

CVE-2009-1384

pamkrb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux RHEL 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

CVE-2009-1803: Exposure of Sensitive Information to an Unauthorized Actor

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

DEBIAN-CVE-2009-1769

The web interface in Open Computer and Software Inventory Next Generation OCS Inventory NG 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames...

DEBIAN-CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-1999-0656: Undefined Security Weakness

The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names...

AZL-34842 CVE-1999-0656 affecting package kernel for versions less than 6.6.35.1-4

The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names...