Buffer overflow

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...

CVE-2017-15804

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...

UBUNTU-CVE-2017-15804

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...

CVE-2017-15804

The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...

Information Leakage Vulnerability in CTG's EZH Mobile APP

EZHI Mobile AP is a one-stop human resources services handheld application platform, covering personnel services, health management, flexible benefits and other business areas, providing online human resources services for registered users and the employees they serve. There is an information...

CVE-2017-12844

Cross-site scripting XSS vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name...

Default configuration

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note...

CVE-2016-0762

Removed by vendor...

Information Disclosure

Moodle is vulnerable to information disclosure. This is because global search does not respect the Force login for profiles setting and displays user names to unauthenticated users...

Authconfig Information Disclosure Vulnerability

Authconfig is a graphical and command line utility program. The program can provide basic client configuration for LDAP, Kerberos 5 and Winbind. An information disclosure vulnerability exists in Authconfig version 6.2.8. A remote attacker could exploit this vulnerability to disclose the existence...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

Code injection

In Moodle 3.2.x, global search displays user names for unauthenticated users...

CVE-2017-2643

In Moodle 3.2.x, global search displays user names for unauthenticated users...

tomcat: timing attack in Realm implementation

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Harvest: Leak of all project names and all user names , even across applications

Summary ------------ All project names and user names can be leaked, even cross application. Steps to reproduce ------------ 1. Create a new expense, this should generate a POST request like this: bash POST /api/v2/expenses?userid=1340164 HTTP/1.1 Host: 8888sasdf.harvestapp.com - snip -...

CVE-2016-6210

A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses...

New Relic: Vulnerable Link Leaks the User Names

Hello, Vulnerable Link: https://rpm.newrelic.com/accounts/XXXXXX/setup POC: Login to the Account. Visit the Above Link. Now, Log Out! Visit that Link Again. Here you go!!! "Display Name" is leaking in front, and the "first name" and "last name" is leaking on the right side bar. Thanks! regards,...

rubygem-actionpack: Timing attack vulnerability in basic authentication in Action Controller

A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare strings could differ depending on input, possibly allowing a remote attacker to determine valid user names and passwords using a timing...

Timing attack vulnerability in basic authentication in Action Controller.

There is a timing attack vulnerability in the basic authentication support in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2015-7576. Versions Affected: All. Not affected: None. Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 Impact ------ Due to the w...