CVE-2016-6210

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provid...

ALPINE-CVE-2016-6210

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provid...

CVE-2016-6210

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provid...

Accellion FTA Multiple Vulnerabilities

Accellion FTA is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ownCloud Multiple Vulnerabilities (Feb 2017) - Linux

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...

ownCloud Multiple Vulnerabilities (Feb 2017) - Windows

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...

Phabricator: Enumerating emails through "Forgot Password" form

mongoose mongoose mongoose Hi! I am testing typical local installation of Phabricator. Using the forgot password form it is possible to enumerate users emails because of message There is no account associated with that email address.. So attacker theoretically can figure out registered users emai...

Server: User enumeration with error messages

This issue occurs at sending a password reset E-Mail, where a difference in error messages could allow an attacker to determine if the username is valid or not For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/?author=1...

Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?author=1...

ownCloud: User Information Disclosure via REST API

Hello, REST-API, allows anonymous access to functionality that allows a hacker to list all users who have published a post on a WordPress site. Unfortunately, this generally includes the admin account POC: https://owncloud.com/wp-json/wp/v2/users/ https://owncloud.com/wp-json/wp/v2/users/1/ Kind...

WordPress Stop User Enumeration 1.3.4 User Enumeration Vulnerability

WordPress Stop User Enumeration plugin version 1.3.4 fails to stop user enumeration. Details ================ Software: Stop User Enumeration Version: 1.3.4 Homepage: https://wordpress.org/plugins/stop-user-enumeration/ Advisory report:...

Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses

The Stop User Enumeration WordPress plugin was affected by an Username Enumeration Bypasses security vulnerability...

WordPress Stop User Enumeration 1.3.4 User Enumeration

Details ================ Software: Stop User Enumeration Version: 1.3.4 Homepage: https://wordpress.org/plugins/stop-user-enumeration/ Advisory report: https://security.dxw.com/advisories/stop-user-enumeration-does-not-stop-user-enumeration/ CVE: Awaiting assignment CVSS: 5 Medium;...

Gratipay: User Enumeration

Dear Gratipay Team, there is a Username Disclosure of a user in your web application's Source Code . For futher detail i have enclosed the screenshot of the vulnerability . Please find the attachment !! Preventive Measure:: hide username fromm sourcr code Encrypt the username...

ntop-ng 2.5.160805 - Username Enumeration Exploit

Exploit for multiple platform in category web applications Exploit title: ntopng user enumeration Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 04-08-2016 Vendor homepage: ntop.org Software version: v.2.5.160805 !/usr/env/python import os import sys import urllib import urllib2 impo...

ntop-ng 2.5.160805 Username Enumeration

Exploit title: ntopng user enumeration Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 04-08-2016 Vendor homepage: ntop.org Software version: v.2.5.160805 !/usr/env/python import os import sys import urllib import urllib2 import cookielib server = 'ip.add.re.ss' username = 'ntopng-use...

User Enumeration Vulnerability in Journalx 2.0, a Remote Processing System for Journal Manuscripts

Journalx 2.0 is a remote processing platform for journal manuscripts developed independently by Beijing Magtech. A user enumeration vulnerability exists in Journalx 2.0. An attacker can exploit the vulnerability to obtain valid user accounts, resulting in an exhaustive attack...

GLSA-201612-18 : OpenSSH: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201612-18 OpenSSH: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could cause Denial of Service and...

OpenSSH: Multiple vulnerabilities

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details. Impact Remote attackers could cause Denial of Service an...