PenTales: “User enumeration is not a vulnerability” – I beg to differ

At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlig...

CVE-2023-3336

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users...

CVE-2023-3336

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users...

Privilege escalation

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users...

CVE-2023-3336 TN-5900 Series User Enumeration Vulnerability

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users...

CVE-2023-3336 TN-5900 Series User Enumeration Vulnerability

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users...

CVE-2023-3336

TN-5900 Series (version 3.3 and earlier) is affected by a user enumeration vulnerability that could allow a remote attacker to determine whether a user is valid during password recovery via the web login page, potentially enabling brute-force attempts with valid accounts. Multiple sources (CVE-20...

Moxa Tn-5900 安全漏洞

Moxa Tn-5900 is a series of En50155 wall mount routers from China's Moxa MOXA. The Moxa Tn-5900 suffers from a user enumeration vulnerability, which can be exploited by an attacker to determine if a user is valid during password recovery via the web login page, and to conduct a brute force attack...

CVE-2023-22359

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

CVE-2023-22359

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

CVE-2023-22359

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

Code injection

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

UBUNTU-CVE-2023-22359

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

CVE-2023-22359 User-enumeration in RestAPI

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

CVE-2023-22359

CVE-2023-22359 describes a user-enumeration issue in Checkmk versions up to 2.2.0p4. The provided documents consistently frame the vulnerability as an authenticated user enumeration of usernames, without detailing specific exploit steps, affected modules, or exploitability in the wild. No concret...

CVE-2023-22359 User-enumeration in RestAPI

User enumeration in Checkmk =2.2.0p4 allows an authenticated attacker to enumerate usernames...

PT-2023-18454 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.2.0p4 Description: The issue allows an authenticated attacker to enumerate usernames through user enumeration. Recommendations: For versions prior to 2.2.0p4, update to a version that contains a fix for this issue...

CVE-2023-2261

The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handleajaxcall function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of...

CVE-2021-4337 Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wpajaxsvxajaxfactory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-3064

Anonymous user may get the list of existing users managed by the application, that could ease further attacks see CVE-2023-3065 and 3066This issue affects Mobatime mobile application AMXGT100 through 1.3.20...