41 matches found
CVE-2022-21659
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...
CVE-2020-8213
An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing...
CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...
CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...
Umbraco 信息泄露漏洞
Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. An information disclosure vulnerability exists in Umbraco version 14.0.0 and earlier, which stems from the ability to determine the existence of an account based on an analysis of the response code and the...
Liferay Portal and Liferay DXP Security Vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
GHSA-M392-235J-9R7R TYPO3 CMS vulnerable to User Enumeration via Response Timing
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C 4.9 Problem It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3...
CVE-2022-36105 User Enumeration via Response Timing in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd part...
CVE-2022-36105 User Enumeration via Response Timing in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd part...
TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-007...
TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-007...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality of the Nakama Console for valid and invalid email addresses or usernames. Proof of Concept 1. Login to the Nakama Console as admin and create a User [email protected] 2. Logout 3. Attempt a Login with an incorrect passwor...
Code injection
The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time...
Observable Response Discrepancy in Flask-AppBuilder
Impact User enumeration in database authentication in Flask-AppBuilder 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Patches Upgrade to 3.4.4 Workarounds References For more information If you have an...
CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...
CVE-2020-8213
CVE-2020-8213 affects UniFi Protect; information disclosure allows unauthenticated attackers to enumerate valid usernames via HTTP response behavior and timing in versions before 1.13.4-beta.5. Root cause: mis-handling of authentication/response timing revealing usernames (per the sources). Impac...
TLS response timings can indicate network contents – Opera Security Advisories
When Opera receives incorrectly encrypted network data, Opera will detect this, and let the sender know that the data was not understood. Such encrypted error responses are marginally faster than regular responses. An attacker with access to the network, can by replacing network data measure...
TLS response timings can indicate network contents
When Opera receives incorrectly encrypted network data, Opera will detect this, and let the sender know that the data was not understood. Such encrypted error responses are marginally faster than regular responses. An attacker with access to the network, can by replacing network data measure...
CVE-2004-1602
ProFTPD 1.2.x (including 1.2.8 and 1.2.10) is vulnerable to username enumeration via timing differences in responses, enabling remote attackers to identify valid usernames. Root cause: timing-based information disclosure in login handling. Affected products: ProFTPD before 1.2.11. Impact: partial...