Flask-AppBuilder Observable Response Discrepancy

Impact User enumeration in database authentication in Flask-AppBuilder = 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. Patches Upgrade to flask-appbuilder=4.5.3 Workarounds Downgrade...

Flask-AppBuilder Observable Response Discrepancy

User enumeration in database authentication in Flask-AppBuilder = 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

Extreme Networks Extreme ExtremeCloud IQ Site Engine 信息泄露漏洞

Extreme Networks ExtremeCloud IQ Site Engine Extreme Networks XIQ-SE is a site engine from Extreme Networks, Inc. providing end-to-end management of wired and wireless devices from the edge to the data center and across multi-vendor environments. A security vulnerability exists in Extreme Network...

PT-2025-9026 · Xiq-Se · Xiq-Se

Name of the Vulnerable Software and Affected Versions: XIQ-SE versions prior to 24.2.11 Description: A server misconfiguration in XIQ-SE may allow user enumeration under specific conditions. Recommendations: For versions prior to 24.2.11, update to version 24.2.11 or later to resolve the issue...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

The CVE-2024-38290 issue affects Extreme Networks’ XIQ-SE before 24.2.11, arising from a server misconfiguration that may allow user enumeration under specific conditions. Impact is limited to misconfiguration-driven exposure of usernames; no exploitation details are provided beyond this behavior...

MikroTik RouterOS 6.43 - 7.17.2 User Enumeration Vulnerability

MikroTik RouterOS is prone to a user enumeration vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:mikrotik:routeros...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26373

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua user endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26373

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua user endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26373

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua user endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26374

CVE-2025-26374 affects Q-Free MaxTime ≤ 2.11.0. The issue is CWE-862 Missing Authorization in maxprofile/users/routes.lua, enabling an authenticated low-priv attacker to enumerate users via crafted HTTP requests. Impact: potential disclosure of user identities; mitigation/patch details are not pr...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...