PT-2018-15283 · Openstack · Openstack Keystone

Name of the Vulnerable Software and Affected Versions: OpenStack Keystone versions through 14.0.1 Description: The issue allows for user enumeration due to the difference in response times for valid and invalid usernames when making a POST request to the "/v3/auth/tokens" endpoint. The vendor vie...

EulerOS 2.0 SP3 : openssh (EulerOS-SA-2018-1405)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the...

CVE-2018-1697

CVE-2018-1697 affects IBM Maximo Asset Management 7.6 and possibly related IBM Maximo products when installed on affected core versions. An authenticated user could enumerate usernames by sending a specially crafted HTTP request, leading to information disclosure with a CVSS v3 base score of 4.3 ...

OpenSSH User Enumeration

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

JobCareer < 2.4.1 - User enumeration & Reset password

The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...

OpenSSH 7.7 - User Enumeration (2)

OpenSSH 7.7 - User Enumeration 2 !/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass...

OpenSSH < 7.7 - User Enumeration (2)

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

OpenSSH < 7.7 - User Enumeration Exploit (2)

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

Exchange email enumeration

Error-based user enumeration for Office 365 integrated email addresses //usr/bin/env go run "$0" "$@"; exit "$?" package main import "crypto/tls" "fmt" "metasploit/module" "msmail" "net/http" "strconv" "strings" "sync" func main metadata := &module.Metadata Name: "Exchange email enumeration",...

TerraMaster TOS User Enumeration Vulnerability

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A security vulnerability exists in the usertable.php endpoint in TerraMaster TOS...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

Code injection

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

CVE-2018-13361 affects TerraMaster TOS version 3.1.03 (and related entries) via the endpoint in usertable.php , where the modgroup parameter enables an attacker to enumerate all system users. The vulnerability is described as allowing user listing, with no explicit exploitation details provided i...

Information Disclosure

catalina is vulnerable to information disclosure attacks. The vulnerability exists as user enumeration is possible throug the FORM authentication as it does not check if credentials is null...

SUSE-SU-2018:3686-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration ...

Microsoft Active Directory Federated Services (ADFS) User Enumeration Vulnerability

Microsoft Active Directory Federated Services ADFS suffers from a time-based user enumeration vulnerability. + Credits: Joshua Platz aka Binary1985 + CVE ID: Requested + Website: https://github.com/binary1985 + Source:...

Microsoft Active Directory Federated Services (ADFS) User Enumeration Vulnerability

Microsoft Windows Server 2019 and others are a series of operating systems released by Microsoft Corporation, U.S.A. Active Directory Federation Services AD FS is an Active Directory Federation Service that runs on Windows systems. The service provides Web Single Sign-On SSO technology that enabl...

Microsoft Active Directory Federated Services (ADFS) User Enumeration

Credits: Joshua Platz aka Binary1985 + CVE ID: Requested + Website: https://github.com/binary1985 + Source: https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/ADFS-Timing-Attack Vendor: ========================== http://www.microsoft.com Product: =========== Active...