Legal Robot: Issues with Forgot password Error Handling

Hello @team, I found a similar issue to 249695.Where user when giving an error email id it is not showing any error response.This is not of high impact but this might throw the users in confusing state as there is no error message user will be waiting for the server response. Steps to reproduce:...

DALIM ES Multiple Vulnerabilities

DALIM ES is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dalim:escore"; if description...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration Exploit

Exploit for jsp platform in category web applications !/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 buil...

DALIM SOFTWARE ES Core 5.0 Build 7184.1 User Enumeration

!/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration

!/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration !/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0...

DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness

Summary ES is the new Enterprise Solution from DALIM SOFTWARE built from the successful TWIST, DIALOGUE and MISTRAL product lines. The ES Core is the engine that can handle project tracking, JDF device workflow, dynamic user interface building, volume management. Each ES installation will have...

Legal Robot: User enumeration from failed login error message

A security researcher reported an issue around user enumeration through examination of the failed registration error message. Since this change was reported, Legal Robot has switched to a method wherein any registration attempts for accounts that already exist will be redirected to the same...

openssh: User enumeration via covert timing channel

A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses...

authconfig: Information leak when SSSD is used for authentication against remote server

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack...

WordPress REST API plugin user enumeration vulnerability

WordPress is a free and open source blogging software and content management system that uses PHP and MySQL as its platform. A user enumeration vulnerability exists in the WordPress REST API plugin version 1.3.8, which can be exploited by an attacker to stop user enumeration...

WordPress Stop User Enumeration 1.3.8 User Enumeration

Details ================ Software: Stop User Enumeration Version: 1.3.8 Homepage: https://wordpress.org/plugins/stop-user-enumeration/ Advisory report: https://security.dxw.com/advisories/stop-user-enumeration-rest-api/ CVE: Awaiting assignment CVSS: 5 Medium; AV:N/AC:L/Au:N/C:P/I:N/A:N Descripti...

Legal Robot: User enumeration

A security researcher discovered that an unrelated upgrade in our authentication process caused a potential user enumeration vulnerability. The vulnerability was mitigated by existing rate limiting processes, but an attacker could determine which users already had an account based on the error co...

Legal Robot: 2FA user enumeration via login

While going live with additional 2FA options, a security researcher discovered that during login, users that had enabled 2FA were prompted for a second factor, even with an incorrect password i.e. LR correctly rejected the login attempt without a second factor, but rejected all attempts for that...

Legal Robot: 2FA user enumeration via password reset

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...

Apple macOS Server User Enumeration Vulnerability

Apple Mac OS X is a specialized operating system developed by Apple for Mac computers. A user enumeration vulnerability exists in Apple macOS Server. An attacker exploits this vulnerability to obtain a valid username and launch further attacks...

Legal Robot: https://www.legalrobot.com/

Hello, I found a info disclosure vulnerability. We can enumerate emails via userid parameter from Manage users. And I found that : [email protected] [email protected] [email protected] [email protected] [email protected] I attached photos from burp repeater to be more explici...

CVE-2017-7488

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack. Mitigation Possible workaroun...

CVE-2017-7945

The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account nam...

WPSeku - Simple Wordpress Security Scanner

WPSeku is a black box WordPress vulnerability scanner that can be used to scan remote WordPress installations to find security issues. Usage | | \ \ /\ / / ' / |/ \ |/ / | | | \ V V /| | \ \ / | || | // | ./|/||\,| || -- WPSeku - Wordpress Security Scanner -- WPSeku - v0.1.0 -- Momo Outaadi...