ZITADEL "ignoring unknown usernames" vulnerability

Impact ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a...

PT-2024-40448

Name of the Vulnerable Software and Affected Versions PersistedUsernamePasswordProvider affected versions not specified Description The issue concerns a timing attack that could disclose the existence of accounts based on the hashing of passwords. This occurred because password hashing was only...

Code injection

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

PT-2022-14527 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue concerns a missing permission check in Android, allowing an attacker to determine if an account exists on the device. This could lead to local information disclosure, requiring User execution...