26 matches found
CVE-2026-11781
The Adminify WordPress plugin (versions before 4.2.10 ) contains a sensitive information disclosure vulnerability in its global search AJAX feature. The root cause is a lack of per-user read-capability checks on the search results. This allows users with low-privilege roles, such as Contributor ,...
CVE-2026-42058: Incorrect Permission Assignment for Critical Resource
An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
EUVD-2024-39167
Malicious code in bioql PyPI...
CVE-2024-41723 BIG-IP iControl REST vulnerability
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2024-41723
CVE-2024-41723 affects BIG-IP iControl REST. A remote authenticated attacker with network access can view only usernames in the BIG-IP system via the iControl REST interface; there is no data plane exposure (control plane issue). Affected product versions are listed in F5 advisory: BIG-IP Next/ B...
K10438187: BIG-IP iControl REST vulnerability CVE-2024-41723
Security Advisory Description Undisclosed requests to BIG-IP iControl REST can lead to an information leak of user account names. CVE-2024-41723 Impact This vulnerability allows for a remote authenticated attacker with network access to the iControl REST interface, through the BIG-IP management...
CVE-2024-41723: Exposure of Sensitive Information to an Unauthorized Actor
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
Authentication flaw
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
CVE-2022-44023
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...
CVE-2022-44023
PwnDoc through 0.5.3 is vulnerable to information disclosure: remote attackers can identify disabled user account names by exploiting differences in authentication response messages. Affected software is PwnDoc versions 0.5.3 and earlier. The exact root cause is not detailed in the connected docu...
CVE-2022-44022
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
CVE-2022-44023
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...
CVE-2022-44022
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...
GHSA-683W-84M7-P8PW Plone User account enumeration via crafted URL
membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...
PT-2019-2505
Name of the Vulnerable Software and Affected Versions БАРС.Web-Своды affected versions not specified Description The issue is related to weaknesses in the authorization mechanism of the platform. It can be exploited by a remote attacker using specially crafted POST requests to guess user account...
Design/Logic Flaw
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI ...
Design/Logic Flaw
A vulnerability was identified in Lenovo XClarity Administrator LXCA before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed...
CVE-2017-3764: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was identified in Lenovo XClarity Administrator LXCA before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed...
