3427 matches found
CVE-2013-6043
CVE-2013-6043 affects Softaculous Webuzo prior to 2.1.4 where the login function reveals different error messages depending on whether a user account exists, allowing remote username enumeration. The issue is documented alongside related vulnerabilities (CVE-2013-6041/6042) in Webuzo 2.1.3-era ad...
Windows Gather Active Directory Users
This module will enumerate user accounts in the default Active Domain AD directory and stores them in the database. If GROUPMEMBER is set to the DN of a group, this will list the members of that group by performing a recursive/nested search i.e. it will list users who are members of groups that a...
mysql: Remote Preauth User Enumeration flaw
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...
Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration
This module can be used to bruteforce RIDs associated with the domain of the SQL Server using the SUSERSNAME function via Error Based SQL injection. This is similar to the smblookupsid module, but executed through SQL Server queries as any user with the PUBLIC role everyone. Information that can ...
CVE-2014-8000
Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...
CVE-2014-8000
CVE-2014-8000 affects Cisco Unified Communications Manager IM and Presence Service 9.1(1). The vulnerability arises from improper sanitization of returned messages, causing different URL responses depending on whether a username exists, enabling remote attackers to enumerate valid user accounts v...
GitLab User Enumeration
The GitLab 'internal' API is exposed unauthenticated on GitLab. This allows the username for each SSH Key ID number to be retrieved. Users who do not have an SSH Key cannot be enumerated in this fashion. LDAP users, e.g. Active Directory users will also be returned. This issue was fixed in GitLab...
mysql: Remote Preauth User Enumeration flaw
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...
mysql: Remote Preauth User Enumeration flaw
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...
SSH Username Enumeration
This module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The default action sends a malformed corrupted SSHMSGUSERAUTHREQUEST packet using public key authentication must be enabled to enumerate users. On some versions of OpenSSH under some configurations,...
HackerOne: Enumeration/Guess of Private (Invited) Programs
Hey, This bug allows anyone to enumerate usernames of invited programs.For example there are two kinds of program at HackerOne - Public programs and Invited programs. Generally invited programs are only accessible to certain users based on reputation system. Now, for most public programs the...
http-avaya-ipoffice-users NSE Script
Attempts to enumerate users in Avaya IP Office systems 7.x. Avaya IP Office systems allow unauthenticated access to the URI '/system/user/scnuserlist' which returns a XML file containing user information such as display name, full name and extension number. Tested on Avaya IP Office 7.027. Script...
CVE-2014-3662
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...
Design/Logic Flaw
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...
CVE-2014-3662
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...
CVE-2014-3662
CVE-2014-3662 affects Jenkins before 1.583 and LTS before 1.565.3. The vulnerability allows remote attackers to enumerate user names via login-related vectors. This is documented in multiple sources (e.g., GHSA/FIX2M entry and related OpenVAS entries). The connected documents confirm the affected...
CVE-2014-3662
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...
Sierra Library Services Platform Multiple Vulnerability Disclosure
Product: Sierra Library Services Platform Vendor: Innovative Interfaces Inc Vulnerable Version: 1.23 Tested Version: 1.23 Vendor Notification: June 19, 2014 Public Disclosure: August 26, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2014-5136 Risk Level: Medium CVSSv2 Ba...
Avolve Software ProjectDox Multiple Vulnerability Disclosure
--------------------------------------------------------------------- Product: ProjectDox Vendor: Avolve Software Vulnerable Version: 8.1 Tested Version: 8.1 Vendor Notification: May 30, 2014 Public Disclosure: September 3, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference:...