PT-2020-12524 · Typo3 · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 10.4.0 through 10.4.1 Description: The issue allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts using time-based attacks with the password reset functionality for backend...

Information disclosure

Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames...

Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System

Summary Open Source OpenSSH is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an...

Vulnerability Spotlight: Zoom Communications user enumeration

Video conferencing and calling software has spiked in popularity as individuals across the globe are forced to stay home due to the COVID-19 pandemic. There are a plethora of players in this space, with one or two getting increased attention. One service in particular — Zoom — has received an...

Zoom Communications Registered Users Enumeration

Summary Zoom doesn’t properly validate certain XMPP requests coming from the clients, which can lead to disclosure of details about registered users. Tested Versions Zoom Service As Of April 9th 2020 Product URLs https://zoom.us CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE...

User Enumeration

Overview Affected versions of this package are vulnerable to User Enumeration wolfSSL 4.3.0 has mulmod code in wceccmulmodex in ecc.c that does not properly resist timing side-channel attacks. Remediation Upgrade wolfssl to version 5.0.0 or higher. References - GitHub Gist - GitHub PR...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

Code injection

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576

CVE-2020-11576 affects Argo CD (v1.5.0) with a user-enumeration flaw in the /api/v1/session endpoint, which returned 401 for existing usernames and 404 for non-existing ones. This behavior allowed enumeration of valid (non-SSO) usernames. The issue is fixed in v1.5.1; upgrading to v1.5.1 or later...

PT-2020-12695 · Intuit · Argo

Name of the Vulnerable Software and Affected Versions: Argo version v1.5.0 Description: The issue allowed attackers to determine the usernames of valid non-SSO accounts. This was possible because the /api/v1/session endpoint returned a 401 status code for an existing username and a 404 status cod...

CVE-2020-11576: Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

Exploit for Incorrect Authorization in Jenkins Git

CVE-2018-1000110: User and Node Enumeration Through Jenkins Git Plugin v3.7 Description: An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users. Versions...

CVE-2019-19677

arxes-tolina 3.0.0 allows User Enumeration...

CVE-2019-19677

arxes-tolina 3.0.0 allows User Enumeration...

Design/Logic Flaw

arxes-tolina 3.0.0 allows User Enumeration...

CVE-2019-19677

arxes-tolina 3.0.0 allows User Enumeration...

CVE-2019-19677

The provided documents confirm CVE-2019-19677 affects arxes-tolina 3.0.0 and results in User Enumeration. The CVE entry consistently states: “arxes-tolina 3.0.0 allows User Enumeration.” Supporting data include NVD records with CVSS 2.0 (4.0) and CVSS 3.1 (4.3) impact scores, indicating potential...

PT-2020-10219

Name of the Vulnerable Software and Affected Versions arxes-tolina version 3.0.0 Description The issue allows user enumeration. Recommendations For arxes-tolina version 3.0.0, at the moment, there is no information about a newer version that contains a fix for this issue...