PT-2024-20807 · Php-Jwt · Php-Jwt

Name of the Vulnerable Software and Affected Versions: php-jwt version 1.0.0 Description: The issue arises from the use of strcmp to verify authentication, which is not a constant-time comparison. This makes it easier for attackers to bypass authentication via a timing side channel...

PwnDoc 安全漏洞

PwnDoc is a software application. Penetration test report generator. A security vulnerability exists in PwnDoc version 0.5.3, which stems from a vulnerability that could allow a remote attacker to identify disabled user account names by exploiting the response time of authentication attempts...

PT-2022-27084 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions 0.5.3 and earlier Description: The issue allows remote attackers to identify valid user account names by leveraging response timings for authentication attempts. Recommendations: For PwnDoc versions 0.5.3 and earlier, at the...

PwnDoc 授权问题漏洞

PwnDoc is a software application. Penetration test report generator. A security vulnerability exists in PwnDoc version 0.5.3, which stems from a vulnerability that could allow a remote attacker to identify valid user account names by exploiting the response time of authentication attempts...

CVE-2022-44022

PwnDoc up to version 0.5.3 is affected by an authentication timing flaw that could allow remote attackers to enumerate valid user account names. Affected component is the authentication mechanism in PwnDoc (0.5.3 and earlier). The root cause is timing-based disclosure during login attempts, enabl...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3. An attacker exploited the vulnerability to distinguish between existing and non-existing user accounts by observing the response time...

PT-2022-13264 · Qlik · Qlik Sense Enterprise

Name of the Vulnerable Software and Affected Versions: Qlik Sense Enterprise on Windows affected versions not specified Description: A vulnerability in Qlik Sense Enterprise on Windows could allow a remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by...

The vulnerability of the OpenSSH cryptographic protection mechanism lies in the varying responses of the server to authentication requests. This allows attackers to discover existing user accounts.

The vulnerability of the OpenSSH cryptographic protection mechanism is related to the varying responses of the server to authentication requests, depending on whether corresponding user accounts are present or absent. Exploiting this vulnerability allows a perpetrator to discover existing user...

PYSEC-2014-75

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...