ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities

ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities Systems Affected Product : ManageEngine Password Manager Pro Company : ZOHO Corp. Build Number : 8.1 to 8.3 and probably earlier versions Affected Versions : 8102 to 8302 and probably earlier versions Product Description...

Mautic 1.3.0 CSRF / XSS / User Enumeration / DoS

Exploit Title: Mautic v1.3.0 Multiple Vulnerabilities Date: 01/04/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: https://www.mautic.org/ Version: 1.3.0 Category: Multiple Vulnerabilities Mautic description : ======================================================================...

Stop User Enumeration <= 1.3.3 - Username Enumeration Bypass

Using the plugin "Stop User Enumeration 1.3.3" is possible bypass it to get the usernames. Blocked: http://www.example.com/?author%00=%001 Passed: http://www.example.com/?bypass=1&author%00=1...

Stop User Enumeration <= 1.3.3 - Username Enumeration Bypass

Using the plugin "Stop User Enumeration 1.3.3" is possible bypass it to get the usernames. PoC Blocked: http://www.example.com/?author%00=%001 Passed: http://www.example.com/?bypass=1%00=1...

WordPress Stop User Enumeration Plugin <= 1.3.3 - Bypass

This plugin is prone to an username enumeration bypass vulnerability. Solution Update the plugin...

New Relic: User enumeration possible from log-in timing difference

Logging in with a username that already has an account takes longer to process than a username that does not have an account. This can be used to see if a given e-mail has a NewRelic account, and in turn can be used to enumerate all accounts on NewRelic. With an e-mail that already exists, the ti...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

WordPress User Enumeration

The version of WordPress hosted on the remote web server is affected by a user enumeration vulnerability. An unauthenticated, remote attacker can exploit this to learn the names of valid WordPress users. This information could be used to mount further attacks. %NASLMINLEVEL 70300 C Tenable Networ...

Veris: User enumeration via error message

Hi guys, Well, the issue is in authentication process, an attacker able to enumerate registered users on the site via brute forcing the login page, in case when user is not exist, system returns the following error message: "User not exist", in case when user exist, but incorrect password:...

PT-2016-2810

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.3 Description The issue is related to a password hashing error in the ssh network protocol. When SHA256 or SHA512 are used for user password hashing, a timing difference in responses can be leveraged by remote...

Ubuntu: Security Advisory (USN-2915-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : django -- multiple vulnerabilities (f9e6c0d1-e4cc-11e5-b2bd-002590263bf5)

Tim Graham reports : Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth User enumeration through timing difference on password hasher work factor upgrade %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Ubuntu: Security Advisory (USN-2915-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2915-3: Django regression

USN-2915-1 fixed vulnerabilities in Django. The upstream fix for CVE-2016-2512 introduced a regression for certain applications. This update fixes the problem by applying the complete upstream regression fix. Original advisory details: Mark Striemer discovered that Django incorrectly handled...

USN-2915-3 python-django regression

USN-2915-1 fixed vulnerabilities in Django. The upstream fix for CVE-2016-2512 introduced a regression for certain applications. This update fixes the problem by applying the complete upstream regression fix. Original advisory details: Mark Striemer discovered that Django incorrectly handled...

MGASA-2016-0096 Updated python-django packages fix security vulnerability

Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. CVE-2016-2512 Sjoerd Job Postmus discovered that Djan...