CVE-2012-6452

CVE-2012-6452 affects Axway, specifically the Email Firewall deployment using the Secure Messenger component (vulnerable: 6.5 and earlier on EMF). The issue arises because authentication responses differ depending on whether the username exists, allowing remote attackers to enumerate valid userna...

CVE-2012-6452

Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests...

Authentication flaw

Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests...

PT-2014-2386

Name of the Vulnerable Software and Affected Versions Axway Secure Messenger versions prior to 6.5 Updated Release 7 Description The issue allows remote attackers to enumerate users via a series of authentication requests, as the system provides different responses depending on whether the user...

CVE-2012-6452: Improper Authentication

Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests...

Design/Logic Flaw

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names...

Yahoo!: Testing for user enumeration (OWASP‐AT‐002) - https://gh.bouncer.login.yahoo.com

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Coinbase: User Enumeration, Information Disclosure and Lack of Rate Limitation on API

NOTE: I am making this email as I think the response from Coinbase originally, via my emails to them was not correct. They had not acknowledged that this flaw allowed for user enumeration and hence I am posting the report again - in hope of a proper and well evaluated response. The key security...

QNX 6.x phgrafx File Enumeration

QNX 6.x phgrafx file enumeration vulnerability by cenobyte 2013 - vulnerability description: QNX setuid root /usr/photon/bin/phgrafx allows any non-root user to enumerate files and directories due to opendir messages. - vulnerable platforms: QNX 6.5.0SP1 QNX 6.5.0 QNX 6.4.1 QNX 6.3.0 QNX 6.2.0 -...

Kentico CMS 7.0.75 - User Information Disclosure

Kentico CMS 7.0.75 - User Information Disclosure Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software...

Kentico CMS 7.0.75 - User Information Disclosure

Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...

Kentico CMS 7.0.75 User Enumeration

Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...

Slack: Email enumeration

Navigate to the page - https://slack.com/signin Now, entering invalid email address returns an erroneous response. However, if you enter a valid email address like [email protected], it redirects you to a different page where it asks you to choose teams that belongs to [email protected]. You can then...

Webuzo 2.1.3 - Multiple Vulnerabilities

Webuzo 2.1.3 - Multiple Vulnerabilities Exploit Title: Webuzo Multiple Vulnerabilities Date: 7 October 2013 Exploit Author: Mahendra Vendor Homepage: www.webuzo.com Software Link: http://downloads.webuzo.com/va.php Version: 2.1.3, other version might be vulnerable. Tested on: CentOS release 6.2...

IBM BPMS 8.0.0.1 Privilege Escalation / Disclosure

IBM BPMS version 8.0.0.1 suffers from account reconfiguration, privilege escalation, and information disclosure vulnerabilities. Exploit Title: IBM BPMS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link:...

WordPress Stop User Enumeration Security Bypass Vulnerability

WordPress Stop User Enumeration Plugin is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Stop User Enumeration 1.2.4 Bypass

Stop User Enumeration is a WordPress plugin that provides protection against an unauthenticated attacker gaining a list of all WordPress users. This information can aid an attacker in further attacks against the website including brute-force password guessing attacks. This can be performed using...

IBM Lotus Notes Sametime User Enumeration

This module extracts usernames using the IBM Lotus Notes Sametime web interface using either a dictionary attack which is preferred, or a bruteforce attack trying all usernames of MAXDEPTH length or less. Module Options msf use auxiliary/gather/ibm/sametimeenumerateusers msf...

[ike-scan] Discover & Fingerprint IKE Hosts (IPsec VPN Servers)

ike-scan discovers IKE hosts and can also fingerprint them using the retransmission backoff pattern. ike-scan can perform the following functions: Discovery Determine which hosts in a given IP range are running IKE. This is done by displaying those hosts which respond to the IKE requests sent by...

Dropbear SSH Server < 2013.59 Multiple Vulnerabilities

According to its self-reported banner, the version of Dropbear SSH running on this port is earlier than 2013.59. As such, it is potentially affected by multiple vulnerabilities : - A denial of service vulnerability caused by the way the 'bufdecompress' function handles compressed files...