PoC-CVE-2018-15473

PoC-CVE-2018-15473 OpenSSH 7.7及之前的版本存在用户枚举漏洞，原因是在完全解析包含请求的数据包之前，不会对无效认证用户延迟退出，涉及auth2-gss.c、auth2-hostbased.c和auth2-pubkey.c。 CVE: CVE-2018-15473 来自 https://www.openwall.com/lists/oss-security/2018/08/15/5 的分析 在未修补当前版本的情况下，远程攻击者可以轻松测试目标OpenSSH服务器上某个用户是否存在（用户名枚举）： root@kitploit: 87 static int 88...

tookie-osint

我们必须重塑品牌 🔎 概述 Tookie-osint 有一个简单易用的用户界面，而且非常直接。 Tookie-osint 的主要思想是从输入中发现请求的用户名。 Tookie-osint 类似于一个名为 Sherlock 的工具。它会发现不同网站上的所有用户帐户，Tookie-osint 在这项任务上的成功率几乎达到 80%。 我们的工具是由我和社区创建的，可供您使用。 对于因我的工具造成的任何恶意行为和/或责任，我概不负责。: 请注意，Tookie-osint 的创建是为了帮助新的程序员或渗透测试人员进入 OSINT 的世界。我的最终目标是让 Tookie-osint...

o365enum

Office 365 用户枚举 使用 ActiveSync、Autodiscover 或 office.com 登录页面枚举 Office 365 中的有效用户名。 使用方法 o365enum 将从作为第一个参数提供的文件中读取用户名。文件每行应包含一个用户名。输出采用 CSV 格式，便于解析。有效状态可以是 0（无效用户）、1（有效用户）、2（有效用户且密码有效）。 root@kitploit: python3.6 o365enum.py -h usage: o365enum.py -h -u USERLIST -p PASSWORD -n NUM -v -m...

CVE-2018-15473_exploit

CVE-2018-15473 - OPENSSH 7.7 用户枚举 依赖： https://github.com/pyperanger/crypt-curve25519 修复补丁 https://metacpan.org/pod/Net::SSH::Perl 参考资料 https://seclists.org/oss-sec/2018/q3/125 http://www.openwall.com/lists/oss-security/2018/08/15/5 https://isc.sans.edu/diary/24004...

Wordell

Wordell 🌐 Wordell es un potente script de enumeración de WordPress diseñado para hacer que tus evaluaciones de seguridad de WordPress sean más eficientes y completas. Te permite enumerar sitemaps, descubrir nombres de usuario, recopilar inicios de sesión de WordPress, tomar capturas de pantalla y...

ssh_user_enum

sshenumv0.3.py Uso: sshenumv0.3.py opciones Opciones: root@kitploit: -h, --help Muestra este mensaje de ayuda y sale -u --userlist Especifica un archivo de nombres de usuario delimitado por nuevas líneas -i --ip Especifica el objetivo -m --multiplier Especifica el multiplicador de la contraseña...

EUVD-2024-16187

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage...

CVE-2024-0391

The CVE-2024-0391 issue affects WSO2 products with the email OTP flow, where the check user account lock states validation fails, enabling attacker enumeration of registered usernames. This disclosure indicates that valid usernames can be inferred, which could facilitate targeted brute-force or s...

PT-2026-39580

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The check user account lock states feature within the email OTP flow fails to validate user input. This allows an attacker to infer whether specific user account...

RHCOS 3 : Red Hat OpenShift Enterprise 3.1.1 update (Important) (RHSA-2016:0070)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0070 advisory. - commons-fileupload: Arbitrary file upload via deserialization CVE-2013-2186 - stapler-adjunct-zeroclipboard: multiple cross-site...

ZKTeco ZKBioSecurity 安全漏洞

ZKTeco ZKBioSecurity is a web-based integrated platform developed by ZKTeco Corporation in China. Version 3.0 of ZKTeco ZKBioSecurity contains security vulnerabilities. These vulnerabilities stem from user enumeration, and could allow unverified attackers to discover valid usernames by submitting...

CVE-2005-1650

The web mail service in Woppoware PostMaster 4.2.2 build 3.2.5 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames...

BIT-DISCOURSE-2025-64528 Users are able to find users by name even when `enable_names` is off

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enablenames is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix...

PT-2025-48802

Name of the Vulnerable Software and Affected Versions Nagvis Checkmk MultisiteAuth versions prior to 1.9.48 Description An unauthenticated attacker can enumerate Checkmk usernames. This issue affects the user enumeration functionality within the software. Recommendations Update to version 1.9.48 ...

EUVD-2010-0247

Malware in sbrugna...

EUVD-2021-25561

Malware in sbrugna...

EUVD-2009-2664

Malware in sbrugna...

EUVD-2013-4311

Malware in sbrugna...

EUVD-2022-52826

Malicious code in bioql PyPI...

Advisory ROSA-SA-2025-3023

software: kanboard 1.2.47 WASP: ROSA-CHROME unaffected versions = kanboard-1.2.47-0.gitb57deb.4 affected versions kanboard-1.2.47-0.gitb57deb.4 CVE-ID: CVE-2025-52576 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in Kanboard before version 1.2.46 allows existing usernames to be...