CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...

Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block...

CVE-2025-26527

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block...

CVE-2025-26527

CVE-2025-26527 concerns Moodle: non-searchable tags can be discovered by users via the tag search page or the tags block. Multiple connected sources (BIT-MOODLE-2025-26527, GHSA/GHSA-5R85-6H7F-RG3R, OSV entries) corroborate the tag exposure issue. The initial description states the risk clearly, ...

CVE-2023-30956

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0...

EUVD-2023-1342

Strapi through 4.5.5 allows attackers with access to the admin panel to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then th...

CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

SUSE CVE-2018-15919

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration or...

CVE-2022-26643

An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application...

CVE-2022-26643

An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application...

CVE-2022-26643

The CVE-2022-26643 issue affects EasyIO CPT Graphics v0.8 and is described as allowing attackers to enumerate valid users in the application (user discovery). The connected documents confirm the affected product and the basic impact, but do not provide a detailed root cause, exploitable steps, af...

PT-2022-17975

Name of the Vulnerable Software and Affected Versions EasyIO CPT Graphics version 0.8 Description An issue in the application allows attackers to discover valid users. Recommendations For EasyIO CPT Graphics version 0.8, at the moment, there is no information about a newer version that contains a...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

PT-2021-17522 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: An attacker can discover whether a user is present in the database through the password reset feature. This issue only affects products that are no longer supported by the maintainer...

CVE-2020-9989

CVE-2020-9989 is a local information‑disclosure issue in Apple Messages where a local user may discover another user’s deleted messages. The CVE entry is represented in Apple advisories for macOS Big Sur 11.0.1 and relevant iOS/iPadOS/watchOS updates, with the issue described as fixed by improved...

CVE-2020-9988

The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a user’s deleted messages...

CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...

CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters...