CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

Default configuration

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note...

CVE-2016-0762

Removed by vendor...

Information Disclosure

Moodle is vulnerable to information disclosure. This is because global search does not respect the Force login for profiles setting and displays user names to unauthenticated users...

Authconfig Information Disclosure Vulnerability

Authconfig is a graphical and command line utility program. The program can provide basic client configuration for LDAP, Kerberos 5 and Winbind. An information disclosure vulnerability exists in Authconfig version 6.2.8. A remote attacker could exploit this vulnerability to disclose the existence...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

Code injection

In Moodle 3.2.x, global search displays user names for unauthenticated users...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

tomcat: timing attack in Realm implementation

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Harvest: Leak of all project names and all user names , even across applications

Summary ------------ All project names and user names can be leaked, even cross application. Steps to reproduce ------------ 1. Create a new expense, this should generate a POST request like this: bash POST /api/v2/expenses?userid=1340164 HTTP/1.1 Host: 8888sasdf.harvestapp.com - snip -...

CVE-2016-6210

A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses...

New Relic: Vulnerable Link Leaks the User Names

Hello, Vulnerable Link: https://rpm.newrelic.com/accounts/XXXXXX/setup POC: Login to the Account. Visit the Above Link. Now, Log Out! Visit that Link Again. Here you go!!! "Display Name" is leaking in front, and the "first name" and "last name" is leaking on the right side bar. Thanks! regards,...

rubygem-actionpack: Timing attack vulnerability in basic authentication in Action Controller

A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare strings could differ depending on input, possibly allowing a remote attacker to determine valid user names and passwords using a timing...

Timing attack vulnerability in basic authentication in Action Controller.

There is a timing attack vulnerability in the basic authentication support in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2015-7576. Versions Affected: All. Not affected: None. Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 Impact ------ Due to the w...

ESC 8832 Data Controller Multiple Vulnerabilities

Exploit for hardware platform in category web applications =begin Exploit Title: ESC 8832 Data Controller multiple vulnerabilities Date: 2014-05-29 Platform: SCADA / Web Application Exploit Author: Balazs Makany Vendor Homepage: www.envirosys.com Version: ESC 8832 Data Controller Hardware Tested...

ManageEngine EventLog Analyzer 'agentHandler' Information Disclosure

The EventLog Analyzer version installed on the remote web server is affected by multiple information disclosure vulnerabilities : - A flaw exists in the 'agentHandler' servlet that allows a remote attacker to retrieve user names and password hashes and other sensitive information. CVE-2014-6038 -...

CVE-2015-0862

Multiple cross-site scripting XSS vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 message details when a message is unqueued, such as headers or arguments; 2 policy names, which a...

CVE-2015-0862

Multiple cross-site scripting XSS vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 message details when a message is unqueued, such as headers or arguments; 2 policy names, which a...

DEBIAN-CVE-2015-0862

Multiple cross-site scripting XSS vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 message details when a message is unqueued, such as headers or arguments; 2 policy names, which a...