3982 matches found
PT-2016-5175
Name of the Vulnerable Software and Affected Versions Django versions prior to 1.8.10 Django versions 1.9.x prior to 1.9.3 Description The issue allows remote attackers to enumerate users via a timing attack involving login requests. This is due to a problem in the password hasher. Recommendation...
django -- multiple vulnerabilities
Tim Graham reports: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth User enumeration through timing difference on password hasher work factor upgrade...
New Relic: WordPress User Enumeration - blog.newrelic.com
Reporter was able to find an endpoint with the output of all authors. As this is publicly accessible information anyway, we don't consider this to be a security threat...
jenkins: username discovery (SECURITY-110)
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...
WordPress 4.4 User Enumeration Vulnerability
WordPress versions 4.4 and below leak whether or not a username exists in their login flow. Affects: WordPress =v4.4 Vulnerability: Information Disclosure CVE-ID: Pending Impact: Username exists disclosure on /wp-login.php ----- By default, WordPress =4.4 discloses whether a username is registere...
Moderate: Red Hat Bug Fix Advisory: samba bug fix and enhancement update
Updated samba packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines...
Deriv.com: User Enumeration : Due to rate limiting on registration
Hi, There is no rate limiting or improper rate limiting on registration action. So it poses risk of user enumeration vulnerability. Attacker will fire brute force on following http request for email parameter and will analysis results as below : If response code : 302 == User doesn't exist If...
[ERPSCAN-15-025] Oracle E-Business Suite Database user enumeration Vulnerability
ADVISORY INFORMATION Title: Oracle E-Business Suite - Database user enumeration Advisory ID: ERPSCAN-15-025 Advisory URL: http://erpscan.com/advisories/erpscan-15-025-oracle-e-business-suite-database-user-enumeration-vulnerability/ Date published:20.10.2015 Vendors contacted: Oracle 2...
Mango Automation 2.6.0 User Enumeration
Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...
Mango Automation 2.6.0 User Enumeration Weakness
Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The weakness is caused due to...
CVE-2015-3238
The unixrunhelperbinary function in the pamunix module in Linux-PAM aka pam before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service hang via a large password...
CentOS Update for pam CESA-2015:1640 centos7
Check the version of pam SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882253";...
pam: DoS/user enumeration due to blocking pipe in pam_unix module
It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user accounts, or cause a...
http-svn-enum NSE Script
Enumerates users of a Subversion repository by examining logs of most recent commits. Script Arguments http-svn-enum.url This is a URL relative to the scanned host eg. /default.html default: /. http-svn-enum.count The number of logs to fetch. Defaults to the last 1000 commits. slaxml.debug See th...
Oracle E-Business Suite - Database user enumeration vulnerability
Application: E-Business Suite Vendor URL: Oracle Bugs: User enumeration Reported: 17.07.2015 Vendor response: 24.07.2015 Date of Public Advisory:20.10.2015 Reference: Oracle CPU Oct 2015 Authors: Nikita Kelesis, Ivan Chalykin, Alexey Tyurin, Egor Karbutov ERPScan VULNERABILITY INFORMATION Class:...
Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability
A vulnerability in the web-based administrative interface of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to enumerate valid usernames and determine if the usernames have administrative privileges. The vulnerability is due to a logic error in the handling of invalid...
WordPress Stop User Enumeration Plugin <= 1.2.4 - BYPASS
An attacker can bypass the username enumeration protection by using POST requests. Solution Upgrade the plugin...
F5 BIG-IQ Enumeration of users and Information Disclosure
Hi, I'm testing BIG-IQ v 0.0.7028, no the last HF but i don't see the bug fix in the HF1 the new mngmt of F5 BIG-IP, i see that you are loggout and join to the next link LINK : where $user is the user https://127.0.0.1/mgmt/shared/authz/users/$user/ When i open this link and try some diff users...
BIG-IQ 0.0.7028 Information Disclosure
Hi, I'm testing BIG-IQ v 0.0.7028, no the last HF but i don't see the bug fix in the HF1 the new mngmt of F5 BIG-IP, i see that you are loggout and join to the next link LINK : where $user is the user https://127.0.0.1/mgmt/shared/authz/users/$user/ When i open this link and try some diff users...
