User Remote Access Agent Authentication Bypass Man-in-the-Middle

The vulnerability of the Prisma Access Agent, a user remote access agent, relates to errors in the certificate validation process. Exploiting this vulnerability allows an attacker to execute a “man-in-the-middle” type attack...

GitLab Authentication Unauthorized Access

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

MFlash secure data exchange platform Privilege Escalation

The vulnerability of the MFlash secure data exchange platform is related to authentication errors. Exploiting this vulnerability allows a malicious actor to enhance their privileges and direct files to arbitrary users...

Generation of Error Message Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Generation of Error Message Containing Sensitive Information due to the raw message of every server-side AuthenticationException being returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker...

EUVD-2025-209308

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

CVE-2025-14243 Mirror-registry: openshift mirror registry: user enumeration via authentication error messages

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

CVE-2025-14243

CVE-2025-14243 concerns the OpenShift Mirror Registry. The vulnerability allows an unauthenticated remote attacker to enumerate valid usernames and email addresses by eliciting different error messages during authentication failures and account creation. Affected component: OpenShift Mirror Regis...

CVE-2025-14243 Mirror-registry: openshift mirror registry: user enumeration via authentication error messages

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

PT-2026-31329

Name of the Vulnerable Software and Affected Versions OpenShift Mirror Registry affected versions not specified Description A flaw exists in the OpenShift Mirror Registry that allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses through differing error...

Red Hat OpenShift Mirror Registry security vulnerabilities

Red Hat OpenShift Mirror Registry is a lightweight container image repository service provided by Red Hat Corporation. There is a security vulnerability in Red Hat OpenShift Mirror Registry. This vulnerability stems from failed authentication processes and different error messages during account...

Microsoft Authenticator Authentication Disclosure

The vulnerability of the Microsoft Authenticator multi-factor authentication application is related to authentication errors in the handler for the customizable URL scheme. Exploiting this vulnerability can allow a perpetrator to disclose sensitive information...

Shopware has user enumeration via distinct error codes on Store API login endpoint

Summary The Store API login endpoint POST /store-api/account/login returns different error codes depending on whether the submitted email address belongs to a registered customer CHECKOUTCUSTOMERAUTHBADCREDENTIALS or is unknown CHECKOUTCUSTOMERNOTFOUND. The "not found" response also echoes the...

lanserv_ipmi.c component of the Data Compromise

The vulnerability of the lanservipmi.c component of the IPMI device management utility for OpenIPMI is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Rucio WebUI has Username Enumeration via Login Error Message

Summary The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Details When submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on th...

Kibana Privilege Escalation

The vulnerability of the Kibana data visualization service is related to authentication errors. Exploiting this vulnerability allows a malicious actor to gain elevated privileges...

Kibana Privilege Escalation

The vulnerability of the Kibana data visualization service is related to authentication errors. Exploiting this vulnerability allows a malicious actor to gain elevated privileges...

Elementor Devnex Addons Data Compromise

The vulnerability of the Devnex Addons component of the WordPress Elementor plugin, related to authentication errors, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Splunk MCP Server Auth Bypass

The vulnerability of the Splunk MCP Server data processing and analysis application is related to authentication errors. Exploiting this vulnerability allows a malicious actor to bypass the restrictions on allowed commands in the MCP Model Context Protocol...

JD Edwards EnterpriseOne Tools Data Access

The vulnerability of the Object and Environment Tech components of the JD Edwards EnterpriseOne Tools system management resource solution is related to authentication errors. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to data...

CVE-2020-36888 SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script

SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing...