CVE-2018-20170: Exposure of Sensitive Information to an Unauthorized Actor

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an...

PT-2018-15283 · Openstack · Openstack Keystone

Name of the Vulnerable Software and Affected Versions: OpenStack Keystone versions through 14.0.1 Description: The issue allows for user enumeration due to the difference in response times for valid and invalid usernames when making a POST request to the "/v3/auth/tokens" endpoint. The vendor vie...

EulerOS 2.0 SP3 : openssh (EulerOS-SA-2018-1405)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the...

CVE-2018-1697

CVE-2018-1697 affects IBM Maximo Asset Management 7.6 and possibly related IBM Maximo products when installed on affected core versions. An authenticated user could enumerate usernames by sending a specially crafted HTTP request, leading to information disclosure with a CVSS v3 base score of 4.3 ...

OpenSSH User Enumeration

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for...

OpenSSH 7.7 - User Enumeration (2)

OpenSSH 7.7 - User Enumeration 2 !/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass...

OpenSSH < 7.7 - User Enumeration Exploit (2)

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

JobCareer < 2.4.1 - User enumeration & Reset password

The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...

OpenSSH < 7.7 - User Enumeration (2)

!/usr/bin/env python2 CVE-2018-15473 SSH User Enumeration by Leap Security @LeapSecurity https://leapsecurity.io Credits: Matthew Daley, Justin Gardner, Lee David Painter import argparse, logging, paramiko, socket, sys, os class InvalidUsernameException: pass malicious function to malform packet...

TerraMaster TOS User Enumeration Vulnerability

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A security vulnerability exists in the usertable.php endpoint in TerraMaster TOS...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

Code injection

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13361

CVE-2018-13361 affects TerraMaster TOS version 3.1.03 (and related entries) via the endpoint in usertable.php , where the modgroup parameter enables an attacker to enumerate all system users. The vulnerability is described as allowing user listing, with no explicit exploitation details provided i...

PT-2018-11782

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to enumerate system users. This is achieved through the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TOS version 3.1.03, consider restrictin...

CVE-2018-13361: Improper Input Validation

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

Information Disclosure

catalina is vulnerable to information disclosure attacks. The vulnerability exists as user enumeration is possible throug the FORM authentication as it does not check if credentials is null...

SUSE-SU-2018:3686-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration ...