3171 matches found
CVE-2024-52043 User enumeration in HubHub
Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation user enumeration.This issue affects all released HumHub versions: through 1.16.2...
PT-2024-35101 · Humhub · Humhub
Name of the Vulnerable Software and Affected Versions: HumHub versions through 1.16.2 Description: The issue affects HumHub, allowing excavation through user enumeration due to an observable response discrepancy. This discrepancy can lead to the generation of error messages containing sensitive...
HumHub 安全漏洞
HumHub is the HumHub open source suite of open source social networking software written on the Yii PHP framework. A security vulnerability exists in HumHub 1.16.2 and earlier versions, which originates from an error message containing sensitive information that could allow an attacker to perform...
Security Bulletin: IBM Sterling Control Center is vulnerable to User Enumeration
Summary User Enumeration is affecting v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-35114 DESCRIPTION: IBM Sterling Control Center could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. CWE:CWE-204: Observable Response Discrepancy...
CVE-2024-51739
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...
CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...
CVE-2024-51739
CVE-2024-51739 affects Combodo iTop. Unauthenticated access via REST endpoint (webservices/rest.php) enables user enumeration through do_reset_pwd, exposing whether a user exists and aiding brute-force attempts. Descriptions in multiple sources confirm the issue stems from password-reset feedback...
PT-2024-34874 · Comodo +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.11 Combodo iTop versions prior to 3.0.5 Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0 Description: The issue allows an unauthenticated user to perform user enumeration, making it...
ABB Cylon Aspect 3.08.01 (jsonProxy.php) Username Enumeration
Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The jsonProxy.php endpoint on the ABB BMS/BAS controller is vulnerabl...
ABB Cylon Aspect 3.08.01 jsonProxy.php Username Enumeration Vulnerability
ABB Cylon Aspect version 3.08.01 is vulnerable to username enumeration in the jsonProxy.php endpoint. An unauthenticated attacker can interact with the UserManager servlet to enumerate valid usernames on the system. Since jsonProxy.php proxies requests to internal services without requiring...
CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...
CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...
CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...
CVE-2024-48572
CVE-2024-48572 affects AquilaCMS 1.409.20 and earlier. The issue arises from insufficient validation of input in the Add a user feature, where user input is processed as a regular expression and matched against emails to find duplicates, enabling unauthenticated users to enumerate email addresses...
CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...
ROS-20241028-01
Vulnerability in HashiCorp Vault and Vault Enterprise enterprise data archiving platforms is related to user enumeration when using the LDAP authentication method. Exploitation The vulnerability could allow an attacker acting remotely to impact the integrity of the systems...
CVE-2024-48932 ZimaOS Unauthenticated API Discloses Usernames
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint http:///v1/users/name allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be...
ZimaOS 安全漏洞
ZimaOS is an open source operating system project from IceWhaleTech that aims to provide a lightweight, high-performance, secure operating system environment. A security vulnerability exists in ZimaOS prior to version 1.2.4, which stems from the API endpoint /v1/users/login in ZimaOS returning a...
CVE-2024-44762
Summary: CVE-2024-44762 affects Webmin Usermin v2.100 and earlier; it enables attacker’s username enumeration through the password-change flow due to inconsistent error messages. What’s affected: Usermin 2.100 and below (password-change endpoint exposes observable differences in responses when us...