7 matches found
CVE-2026-77582: Observable Timing Discrepancy
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...
PT-2026-96163
Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description Tinyauth exposes a timing difference during authentication attempts that allows a remote observer to distinguish between existing and nonexistent local usernames. This occurs because the loginHandle...
CVE-2014-1816
Microsoft XML Core Services aka MSXML 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover 1 full pathnames on the client system and 2 local usernames embedded in these pathnames via a crafted w...
Design/Logic Flaw
Microsoft XML Core Services aka MSXML 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover 1 full pathnames on the client system and 2 local usernames embedded in these pathnames via a crafted w...
CVE-2014-1816
Microsoft XML Core Services aka MSXML 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover 1 full pathnames on the client system and 2 local usernames embedded in these pathnames via a crafted w...
PT-2014-1687
Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services aka MSXML versions 3.0 through 6.0 Description The issue is related to the processing of XML content and allows attackers to gain access to confidential information. It does not properly restrict the information...
Nortel CVX 1800s will dump all local user names and passwords via SNMP
The Nortel CVX 1800 is a modem bank containing up to 2600 modems per box. Many ISP's are using them for their dial-up customers. While querying the CVX-1800 for SNMP codes to use in a modem statistics program I was writing, I discovered the CVX-1800 will spill out all user names and passwords in...