CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

Design/Logic Flaw

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2020-7057

CVE-2020-7057 affects Hikvision DVR DS-7204HGHI-F1 running V4.0.1 build 180903 web interface. The login endpoint ISAPI/Security/sessionLogin/capabilities returns different responses for failed login attempts based on whether the username exists, enabling user enumeration. The description states o...

8x8: Disclosure of Users Information On Wordpress Api [https://jitsi.org/]

Jitsi was running a default WordPress site that had not yet been hardened to prevent user enumeration via the API...

CVE-2012-3822

Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials...

Security Bulletin: OpenSSH as used by IBM QRadar SIEM is vulnerable to information exposure (CVE-2018-15473)

Summary OpenSSH as used by IBM QRadar SIEM is vulnerable to information exposure Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containi...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Information Disclosure (CVE-2018-1697)

Summary IBM Maximo Asset Management could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. Vulnerability Details CVEID: CVE-2018-1697 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to enumerate usernames using a specially craft...

Design/Logic Flaw

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to enumerate valid user names by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs to...

CVE-2019-18334

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to enumerate valid user names by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs to...

CVE-2019-18334

CVE-2019-18334 affects the SPPA-T3000 Application Server (all versions before Service Pack R8.2 SP2). An attacker with network access can enumerate valid usernames by sending crafted packets to 8090/tcp. The advisory notes no public exploits known at publication. Siemens’ mitigation is to upgrade...

SAP Enable Now Information Disclosure Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. An information disclosure vulnerability exists in SAP Enable Now. An attacker could use this vulnerability to obta...

CVE-2019-0405

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...

CVE-2019-0405

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...

Information disclosure

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...

CVE-2019-0405

CVE-2019-0405 affects SAP Enable Now prior to version 1911, where information leakage exposes the existence of a specific user, enabling user enumeration and information disclosure. The connected sources consistently describe this as a user existence disclosure vulnerability in SAP Enable Now; no...

CVE-2019-0405

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...

VMware Harbor Container Registry for PCF Multiple Security Vulnerabilities

Description VMware Harbor Container Registry for PCF is prone to the following security vulnerabilities. 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery vulnerability 3. A privilege-escalation vulnerability 4. A user-enumeration vulnerability Exploiting this issue...

Harbor User Enumeration Vulnerability

Harbor is an open source trusted cloud native registry. The product is primarily used to store, sign and scan container images for vulnerabilities. A security vulnerability exists in the '/users' API endpoint in Harbor. An attacker could use the vulnerability to bypass restrictions on this endpoi...

CVE-2019-3990

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...

CVE-2019-3990

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...