54 matches found
SSH_Enum_CVE-2018-15473
SSH用户名枚举利用工具 该脚本是原始漏洞利用工具的修改版本，用于对存在漏洞的服务器（OpenSSH 2.3 -u 从列表中枚举用户： python CVE-2018-15473.py -w 4. 脚本将在控制台显示结果。 要求 Python 3.x paramiko 包（使用 pip install paramiko 安装） colorama 包（使用 pip install colorama 安装） 重要 此脚本仅供教育和安全目的使用。不建议在未经明确授权的系统或网络上使用。 致谢 此脚本是原始漏洞利用工具的编辑版本。原始版本的致谢和详细信息请参见此处。...
CVE-2020-35846
CVE-2020-35846 - 泄露 Cockpit 用户名 PoC John Hammond | 2021年7月25日，星期日 用于通过 CVE-2020-35846 泄露 Cockpit 用户名的概念验证 Python 脚本。...
CVE-2018-15473-User-Enumeration-
CVE-2018-15473 – SSH 用户名枚举 一个由我开发的 Python 工具，用于通过利用 CVE-2018-15473 识别有效的 SSH 用户名。 目标信息 服务： SSH 版本： OpenSSH 5.8p1 Debian 1ubuntu3 操作系统： Ubuntu Linux 协议： SSH-2.0 评估： 已针对 CVE-2018-15473（SSH 用户名枚举）进行测试 语言 Python 3 功能特性 使用 Python 3 开发。 通过利用 CVE-2018-15473 枚举有效的 SSH 用户名。 支持自定义用户名字典。 实时显示发现的用户名。...
EUVD-2025-210910
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...
SUSE CVE-2026-27656
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
Zabbix 6.0.x < 6.0.41 / 7.0.x < 7.0.17 / 7.2.x < 7.2.11 Information Disclosure (ZBX-27060)
The version of Zabbix Server installed on the remote host is affected by a vulnerability. A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access...
Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
EUVD-2026-15805
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
GHSA-FG35-5RF6-QG3G Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
CVE-2026-27656
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
CVE-2026-27656
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
CVE-2026-27656
Mattermost contains a vulnerability (CVE-2026-27656) where versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, and 10.11.x
CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to properly validate user identity in the OpenID IsSameUser comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user...
PT-2026-27989
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.4.0 and earlier, 11.3.1 and earlier, 11.2.3 and earlier, 10.11.11 and earlier Description The software does not properly validate user identity within the OpenID IsSameUser comparison logic. This flaw, stemming from over...
CVE-2022-26643
An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application...
CVE-2026-21880
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to...
CVE-2025-64528
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enablenames is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix...