6 matches found
CVE-2020-15392
CVE-2020-15392 Supravizio BPM 10.1.2 上的用户枚举漏洞 描述 在 Supravizio BPM 10.1.2 版本中发现了一个用户枚举漏洞。该问题出现在密码找回过程中，由于返回消息的差异，攻击者能够判断用户是否存在，从而利用有效用户进行暴力破解攻击。 利用方法 要利用此漏洞，需要发起密码找回请求。当输入无效的联系邮箱时，系统显示消息："email not found"；而当输入有效邮箱时，显示："contact the system administrator"。 PoC 无效用户 有效用户 暴力破解 - 无效用户 暴力破解 - 有效用户...
PT-2025-39521
Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description A username enumeration issue exists when Multi-Attribute Login is enabled. The system provides a different response for existing and non-existing usernames, regardless of the validate...
CVE-2025-40653 User enumeration in M3M Printer Server Web
User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames...
CVE-2024-2464 Application users enumeration in CDeX
This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...
DEBIAN-CVE-2009-1273
pamssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...