230 matches found
Answer has Observable Response Discrepancy
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...
CVE-2023-1540
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...
Buffer overflow
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...
CVE-2023-1540 Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...
CVE-2023-1540
CVE-2023-1540 concerns the open‑source knowledgebase app answerdev/answer prior to version 1.0.6. The vulnerability is described as an observable response discrepancy in the GitHub repository’s Answer before 1.0.6, enabling information disclosure during the password reset flow: an attacker could ...
Observable Response Discrepancy
vantage6server is vulnerable to Observable Response Discrepancy. The vulnerability exists because the login requirement is not properly implemented which allows an attacker to brute force password and observe a valid username response...
CVE-2022-39228 Observable Response Discrepancy in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is...
GHSA-36GX-9Q6H-G429 vantage6 vulnerable to Observable Response Discrepancy
Impact We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong...
SUSE CVE-2021-0089
Observable response discrepancy in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
SUSE CVE-2021-0086
Observable response discrepancy in floating-point operations for some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
GHSA-MRQX-MJC4-VFH3 wallabag subject to Improper Authorization via annotations
Impact The annotations feature lets users add annotations on highlighted parts of an entry. The controller does not validate authorization on PUT and DELETE requests which lets a logged user modify or delete any annotation using their ID on their endpoints example.org/annotations/id. These...
Sensormatic Electronics C-CURE 9000
1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. Equipment: C-CURE 9000 Vulnerability: Observable Response Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...
CVE-2022-31248
CVE-2022-31248 is a Spacewalk/spacewalk-java vulnerability in SUSE Manager Server 4.1 and 4.2 where an observable response discrepancy allows remote attackers to enumerate valid usernames. Affected: spacewalk-java before 4.1.46-1 on 4.1 and before 4.2.37-1 on 4.2. There are no exploit details in ...
CVE-2022-31248 SUMA user enumeration via weak error message
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java...
CVE-2022-31248
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java...
GHSA-FWHR-G5R4-XGXF Silverstripe CMS User Enumeration
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...
Observable Response Discrepancy in Lost Password Service
Impact It is possible to enumerate usernames via the forgot password functionality Patches Update to version 10.1.3 or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch Workarounds Apply https://github.com/pimcore/pimcore/pull/10223.patch manually...
CVE-2021-39189 Observable Response Discrepancy in Lost Password Service
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually...