3257 matches found
SMB Use Host SID to Enumerate Local Users
Using the host security identifier SID, Nessus was able to enumerate local users on the remote Windows system. C Tenable Network Security, Inc. @PREFERENCES@ include"compat.inc"; if description scriptid10860; scriptversion"1.62"; scriptsetattributeattribute:"pluginmodificationdate",...
Enumerating users on a Domino webserver
Hi, during a pen-test against a Domino 5.0.8 webserver, I was able to enumerate valid users. A simple "GET /mail/toto.nsf HTTP/1.0" redirects to the login page with a "200 OK" HTTP code if the user "toto" exists and a "404 File not Found" is returned if the user doesn't exist. This issue can allo...
Microsoft Outlook Web Access (OWA) Anonymous Access
It is possible to browse the information of the OWA server by accessing as an anonymous user with the following URL: http://www.example.com/exchange/root.asp?acs=anon After this access, the anonymous user can search for valid users in the OWA server and can enumerate all users by accessing the...
Exchange Public Folders Information Leakage
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com SUMMARY Microsoft Exchange Server handles anonymous access to its Public Folders insecurely. While administrators may disable the "Find Users" features to...
Oracle XSQL query.xsql sql Parameter SQL Injection
One of the sample applications that comes with the Oracle XSQL Servlet allows an attacker to make arbitrary queries to the Oracle database under an unprivileged account. Whilst not allowing an attacker to delete or modify database contents, this flaw can be used to enumerate database users and vi...
Samba 2.0.7 SWAT vulnerabilities
the original writeup can be found at http://www.uberhax0r.net/miah/swat along with all the code mentioned in this advisory The program swat included in the samba distribution allows username and password bruteforcing. An attacker can easily generate userlists and then bruteforce their passwords...
Sun Java Web Server 1.1.32.0 Servlets - information Disclosure
Sun Java Web Server 1.1.32.0 Servlets - information Disclosure source: https://www.securityfocus.com/bid/1498/info The servlet sunexamples.RealmDumpServlet, which is packaged by Default with Sun's Java Web Server, can be used to discover ACLs and local users on the server...
CVE-1999-0407
By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system...
CVE-1999-0259
cfingerd lists all users on a system via search.@target...
PT-1999-1510 · Gnome · Gdm
Name of the Vulnerable Software and Affected Versions: gdm affected versions not specified Description: The issue allows an attacker to identify valid users on a system through error messages generated by gdm when the VerboseAuth setting is enabled. Recommendations: At the moment, there is no...
Multiple Mail Server EXPN/VRFY Information Disclosure
The remote SMTP server answers to the EXPN and/or VRFY commands. The EXPN command can be used to find the delivery address of mail aliases, or even the full name of the recipients, and the VRFY command may be used to check the validity of an account. Your mailer should not allow remote users to u...
CVE-1999-1231
ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server...
CVE-1999-0259
cfingerd lists all users on a system via search.@target...
PT-1997-1113 · Cfingerd · Cfingerd
Name of the Vulnerable Software and Affected Versions: cfingerd affected versions not specified Description: The issue allows cfingerd to list all users on a system via search. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...
CVE-2022-34623
This CVE entry is rejected/not used; reference CVE-2022-32425 instead.
