40 matches found
CVE-2024-29296
CVE-2024-29296 - Portainer CE 2.19.4 におけるユーザー列挙 Portainer CE 2.19.4 にユーザー列挙の脆弱性が発見されました。この問題はユーザー認証プロセス中に発生し、応答時間の差により、リモートの未認証ユーザーがユーザー名が有効かどうかを判断できる可能性があります。 この脆弱性は、Portainer のイシュー 11736 で修正され、Portainer CE バージョン 2.19.5 および 2.20.2 でリリースされました。 概要 脆弱性: ユーザー列挙 製品のベンダー: Portainer 影響を受ける製品コードベース:...
Dropbear_CVE-2013-4434
DropbearCVE-2013-4434 dropbearCVE-2013-4434.sh このスクリプトは、CVE-2013-4434 https://vulners.com/cve/CVE-2013-4434 をチェックします。2013.59 より前の Dropbear SSH Server は、ログオン試行の失敗に対して、ユーザーアカウントが存在するかどうかに応じて異なる時間遅延でエラーメッセージを生成するため、リモートの攻撃者は有効なユーザー名を発見できます。...
cve-2018-15473
CVE-2018-15473 OpenSSH 7.7 以前は、要求を含むパケットが完全に解析されるまで無効な認証ユーザーのベイルアウトを遅延させないため、ユーザー列挙の脆弱性があります。関連するファイル: auth2-gss.c、auth2-hostbased.c、auth2-pubkey.c。 インストール お使いのディストリビューションに相当する openssl-dev パッケージのインストールが必要になる場合があります。 root@kitploit: NOTE: if you're installing on kali, you can skip the pip install;...
CVE-2026-44332: Observable Discrepancy
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...
JLSEC-2026-524
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...
CVE-2025-13473
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The django.contrib.auth.handlers.modwsgi.checkpassword function for authentication via modwsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series such as 5.0.x,...
DivvyDrive Web 安全漏洞
DivvyDrive Web is a file management and sharing system from the Turkish company DivvyDrive. A security vulnerability exists in DivvyDrive Web versions 4.8.2.2 through prior to 4.8.2.15, which stems from the presence of an observable timing difference that could lead to a cross-domain search timin...
CVE-2025-54999: Observable Discrepancy
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...
Mbed TLS 安全漏洞
Mbed TLS is an open source, portable, easy to use, readable and flexible SSL library from Mbed TLS Open Source. A security vulnerability exists in Mbed TLS versions 3.6.1 through 3.6.3 that stems from a timing difference and could lead to plaintext recovery...
CVE-2025-6056: Observable Discrepancy
Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames...
GHSA-52XF-5P2M-9WRV s2n-tls has a potentially observable differences in RSA premaster secret handling
When receiving a message from a client that sent an invalid RSA premaster secret, an issue in s2n-tls results in the server performing additional processing when the premaster secret contains an incorrect client hello version. While no practical attack on s2n-tls has been demonstrated, this cause...
s2n-tls has a potentially observable differences in RSA premaster secret handling
When receiving a message from a client that sent an invalid RSA premaster secret, an issue in s2n-tls results in the server performing additional processing when the premaster secret contains an incorrect client hello version. While no practical attack on s2n-tls has been demonstrated, this cause...
Dell BSAFE Micro Edition Suite 安全漏洞
The Dell BSAFE Micro Edition Suite is a development toolkit from Dell Inc. that provides cryptographic, certificate, and transport layer security for c/c++ applications, devices, and systems. A security vulnerability exists in Dell BSAFE Micro Edition Suite versions prior to 4.6, Dell BSAFE...
Red Hat OpenShift 安全漏洞
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. A security vulnerability exists in Red Hat OpenShift OSIN that stems from an incorrect manipulation of the secret parameter resulting ...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively we can see the...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality of the Nakama Console for valid and invalid email addresses or usernames. Proof of Concept 1. Login to the Nakama Console as admin and create a User [email protected] 2. Logout 3. Attempt a Login with an incorrect passwor...
Unspecified Vulnerability in Dell BSAFE Crypto-C Micro Edition and Dell BSAFE Micro Edition Suite
Dell BSAFE Micro Edition Suite is a development toolkit that provides encryption, certificate, and transport layer security for c/c++ applications, devices, and systems.Dell BSAFE is a security software product that supports cryptographic algorithms, certificate chain validation, and Transport...
Dell BSAFE 安全漏洞
Dell BSAFE Micro Edition Suite is a development toolkit that provides encryption, certificate, and transport layer security for c/c++ applications, devices, and systems.Dell BSAFE is a security software product that supports cryptographic algorithms, certificate chain validation, and Transport...
CVE-2021-31866
CVE-2021-31866 affects Redmine before 4.0.9 and 4.1.x before 4.1.3. An attacker can learn internal authentication keys by observing timing differences in string comparisons in SysController and MailHandlerController, causing information disclosure. Affected product is Redmine (web-based project m...