Cisco WebEx Meetings Server User Enumeration Vulnerability (CNVD-2015-00224)

Cisco WebEx Meetings are web conferencing solutions. The web framework in Cisco WebEx Meetings Server generates different return messages based on the presence or absence of a URL request for a username, allowing a remote attacker to enumerate user accounts through a series of requests...

Cisco Unified Communications Manager IM and Presence Service Enumeration Vulnerability (CSCur63497)

According to its self-reported version, the Cisco Unified Communications Manager IM and Presence Server installed on the remote host is affected by a user enumeration vulnerability due to improper sanitation of returned messages. An attacker can exploit this vulnerability by sending a series of...

Dropbox: WP User Enumeration is possible at https://blog.dropbox.com

Hello security team. I like to report this bug I found. Here are some user ID's proofing user enumeration is possible. User ID 2 : drew User ID 4 : jon User ID 6 : arash User ID 9 : dan User ID 10 : arash-ferdowsi User ID 11 : dropbox-team User ID 13 : ivan It is recommended to rename the admin...

CVE-2013-6043

CVE-2013-6043 affects Softaculous Webuzo prior to 2.1.4 where the login function reveals different error messages depending on whether a user account exists, allowing remote username enumeration. The issue is documented alongside related vulnerabilities (CVE-2013-6041/6042) in Webuzo 2.1.3-era ad...

Windows Gather Active Directory Users

This module will enumerate user accounts in the default Active Domain AD directory and stores them in the database. If GROUPMEMBER is set to the DN of a group, this will list the members of that group by performing a recursive/nested search i.e. it will list users who are members of groups that a...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration

This module can be used to bruteforce RIDs associated with the domain of the SQL Server using the SUSERSNAME function via Error Based SQL injection. This is similar to the smblookupsid module, but executed through SQL Server queries as any user with the PUBLIC role everyone. Information that can ...

CVE-2014-8000

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

CVE-2014-8000

CVE-2014-8000 affects Cisco Unified Communications Manager IM and Presence Service 9.1(1). The vulnerability arises from improper sanitization of returned messages, causing different URL responses depending on whether a username exists, enabling remote attackers to enumerate valid user accounts v...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames...

SSH Username Enumeration

This module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The default action sends a malformed corrupted SSHMSGUSERAUTHREQUEST packet using public key authentication must be enabled to enumerate users. On some versions of OpenSSH under some configurations,...

HackerOne: Enumeration/Guess of Private (Invited) Programs

Hey, This bug allows anyone to enumerate usernames of invited programs.For example there are two kinds of program at HackerOne - Public programs and Invited programs. Generally invited programs are only accessible to certain users based on reputation system. Now, for most public programs the...

http-avaya-ipoffice-users NSE Script

Attempts to enumerate users in Avaya IP Office systems 7.x. Avaya IP Office systems allow unauthenticated access to the URI '/system/user/scnuserlist' which returns a XML file containing user information such as display name, full name and extension number. Tested on Avaya IP Office 7.027. Script...

CVE-2014-3662

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...

CVE-2014-3662

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...

Design/Logic Flaw

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...

CVE-2014-3662

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts...

CVE-2014-3662

CVE-2014-3662 affects Jenkins before 1.583 and LTS before 1.565.3. The vulnerability allows remote attackers to enumerate user names via login-related vectors. This is documented in multiple sources (e.g., GHSA/FIX2M entry and related OpenVAS entries). The connected documents confirm the affected...

Avolve Software ProjectDox Multiple Vulnerability Disclosure

--------------------------------------------------------------------- Product: ProjectDox Vendor: Avolve Software Vulnerable Version: 8.1 Tested Version: 8.1 Vendor Notification: May 30, 2014 Public Disclosure: September 3, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference:...