68 matches found
CVE-2025-24887 OpenCTI bypass of protected attribute update
OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the external flag on/off and change...
CVE-2025-20150
A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an...
CVE-2024-44762
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts...
CVE-2024-39211
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...
CVE-2024-39211
Kaiten 57.128.8 (workflow management system) is affected by CVE-2024-39211. A crafted POST request to the login endpoint can cause information leakage because the login response reveals a user_email field only when the target user exists, enabling remote attackers to enumerate user accounts. This...
CVE-2024-39211
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...
CVE-2023-41166
Stormshield Network Security (SNS) is affected across multiple releases (3.7.0–3.7.39, 3.11.0–3.11.27, 4.3.0–4.3.22, 4.6.0–4.6.9, 4.7.0–4.7.1). The issue allows an attacker to determine whether a specific user account exists on the SNS firewall by issuing remote access commands. The impact is inf...
CVE-2023-34261
Kyocera TASKalfa 4053ci printers through 2VGS000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht einloggen" error rather than a falsch error...
Design/Logic Flaw
An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted...
CVE-2023-37831
The CVE-2023-37831 issue affects Elenos ETG150 FM transmitter v3.12. Reports in multiple sources describe an information-disclosure style vulnerability where login responses enable an attacker to enumerate user accounts based on server behavior when credentials are submitted. CVSS v3.1 base metri...
CVE-2023-28015
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on...
Information disclosure
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on...
CVE-2023-28015 HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on...
CVE-2023-28015
The CVE-2023-28015 affects HCL Domino AppDev Pack IAM service. Vulnerable component: the login/authentication process; root cause is a difference in failure messages during failed logins that can reveal whether a user exists. Consequence: attacker could leverage this to enumerate valid users and ...
CVE-2023-28015 HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on...
PT-2023-21481 · Hcl · Hcl Domino Appdev Pack
Name of the Vulnerable Software and Affected Versions: HCL Domino AppDev Pack affected versions not specified Description: The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration issue. During a failed login attempt, a difference in messages could allow an attacker to...
User account enumeration in Serenity
An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...
GHSA-W7JM-9X4M-8QC3 User account enumeration in Serenity
An issue was discovered in Serenity Serene and StartSharp before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist...
GHSA-89P3-9J8C-FQH4 Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...