CVE-2017-9978

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for common usernames...

ike-scan - Discover and fingerprint IKE hosts (IPsec VPN Servers)

Discover and fingerprint IKE hosts IPsec VPN Servers. Building and Installing ike-scan uses the standard GNU autoconf and automake tools, so installation is the normal process: Run git clone https://github.com/royhills/ike-scan.git to obtain the project source code Run cd ike-scan to enter source...

QuantaStor Software Defined Storage 4.3.1 - Multiple Vulnerabilities

QuantaStor Software Defined Storage 4.3.1 - Multiple Vulnerabilities 1. --- Advisory details --- Title: QuantaStor Software Define Storage mmultiple vulnerabilities Advisory ID: VVVSEC-2017-6943 Advisory URL: http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Date published:...

OSNEXUS QuantaStor 4 Information Disclosure

--- Advisory details --- Title: QuantaStor Software Define Storage mmultiple vulnerabilities Advisory ID: VVVSEC-2017-6943 Advisory URL: http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Date published: 12/08/2017 CVEs: CVE-2017-9978 "Brute force login request using http...

Legal Robot: Issues with Forgot password Error Handling

Hello @team, I found a similar issue to 249695.Where user when giving an error email id it is not showing any error response.This is not of high impact but this might throw the users in confusing state as there is no error message user will be waiting for the server response. Steps to reproduce:...

DALIM ES Multiple Vulnerabilities

DALIM ES is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dalim:escore"; if description...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration Exploit

Exploit for jsp platform in category web applications !/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 buil...

DALIM SOFTWARE ES Core 5.0 Build 7184.1 User Enumeration

!/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration !/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0...

DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness

Summary ES is the new Enterprise Solution from DALIM SOFTWARE built from the successful TWIST, DIALOGUE and MISTRAL product lines. The ES Core is the engine that can handle project tracking, JDF device workflow, dynamic user interface building, volume management. Each ES installation will have...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - User Enumeration

!/usr/bin/env python DALIM SOFTWARE ES Core 5.0 build 7184.1 User Enumeration Weakness Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build...

Legal Robot: User enumeration from failed login error message

A security researcher reported an issue around user enumeration through examination of the failed registration error message. Since this change was reported, Legal Robot has switched to a method wherein any registration attempts for accounts that already exist will be redirected to the same...

openssh: User enumeration via covert timing channel

A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses...

authconfig: Information leak when SSSD is used for authentication against remote server

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack...

WordPress REST API plugin user enumeration vulnerability

WordPress is a free and open source blogging software and content management system that uses PHP and MySQL as its platform. A user enumeration vulnerability exists in the WordPress REST API plugin version 1.3.8, which can be exploited by an attacker to stop user enumeration...

WordPress Stop User Enumeration 1.3.8 User Enumeration

Details ================ Software: Stop User Enumeration Version: 1.3.8 Homepage: https://wordpress.org/plugins/stop-user-enumeration/ Advisory report: https://security.dxw.com/advisories/stop-user-enumeration-rest-api/ CVE: Awaiting assignment CVSS: 5 Medium; AV:N/AC:L/Au:N/C:P/I:N/A:N Descripti...

Legal Robot: User enumeration

A security researcher discovered that an unrelated upgrade in our authentication process caused a potential user enumeration vulnerability. The vulnerability was mitigated by existing rate limiting processes, but an attacker could determine which users already had an account based on the error co...

Legal Robot: 2FA user enumeration via login

While going live with additional 2FA options, a security researcher discovered that during login, users that had enabled 2FA were prompted for a second factor, even with an incorrect password i.e. LR correctly rejected the login attempt without a second factor, but rejected all attempts for that...

Legal Robot: 2FA user enumeration via password reset

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...

Apple macOS Server User Enumeration Vulnerability

Apple Mac OS X is a specialized operating system developed by Apple for Mac computers. A user enumeration vulnerability exists in Apple macOS Server. An attacker exploits this vulnerability to obtain a valid username and launch further attacks...