CVE-2025-26527

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block...

CVE-2025-26527

CVE-2025-26527 concerns Moodle: non-searchable tags can be discovered by users via the tag search page or the tags block. Multiple connected sources (BIT-MOODLE-2025-26527, GHSA/GHSA-5R85-6H7F-RG3R, OSV entries) corroborate the tag exposure issue. The initial description states the risk clearly, ...

CVE-2023-30956

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0...

EUVD-2023-1342

Strapi through 4.5.5 allows attackers with access to the admin panel to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then th...

CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

SUSE CVE-2018-15919

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration or...

CVE-2022-26643

An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application...

CVE-2022-26643

An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application...

CVE-2022-26643

The CVE-2022-26643 issue affects EasyIO CPT Graphics v0.8 and is described as allowing attackers to enumerate valid users in the application (user discovery). The connected documents confirm the affected product and the basic impact, but do not provide a detailed root cause, exploitable steps, af...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

PT-2021-17522 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: An attacker can discover whether a user is present in the database through the password reset feature. This issue only affects products that are no longer supported by the maintainer...

CVE-2020-9989

CVE-2020-9989 is a local information‑disclosure issue in Apple Messages where a local user may discover another user’s deleted messages. The CVE entry is represented in Apple advisories for macOS Big Sur 11.0.1 and relevant iOS/iPadOS/watchOS updates, with the issue described as fixed by improved...

CVE-2020-9988

The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a user’s deleted messages...

CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...

CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...

Design/Logic Flaw

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...

CVE-2018-16251

CVE-2018-16251 : In Creatiwity wityCMS 0.6.2, an injection vulnerability exists in the administrator user discovery path via the Utillisateur menu. The issue arises because several user-related inputs (Nickname, email, firstname, lastname, groupe) are not filtered in the /admin/user/users interfa...

PT-2018-2784

Name of the Vulnerable Software and Affected Versions OpenSSH versions through 7.8 Description The issue is related to the auth-gss2.c file in OpenSSH, which lacks protection of service data. This could allow a remote attacker to disclose protected information. Additionally, remotely observable...

CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...