CVE-2018-19654

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a...

CVE-2018-19654

CVE-2018-19654 affects the Sales & Company Management System (SCMS) up to 2018-06-06. The issue is a discrepancy between a string-validation component and the MySQL query component, allowing registration of a new account with a username that already exists (e.g., test%c2) when the account is alre...

CVE-2018-17368: Undefined Security Weakness

An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks...

CVE-2018-2379

In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint...

CVE-2018-0134

A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine whether a subscriber username is valid. The vulnerability occurs because the Cisco Policy Suite RADIUS server component returns different authentication failure...

WordPress read-and-understood plugin cross-site scripting vulnerability (CNVD-2018-01260)

WordPress is the WordPress Software Foundation of a set of PHP language development of the blogging platform, the platform supports PHP and MySQL server set up a personal blog site. read-and-understood plugin is the use of one of the use of the document reading plugin . A cross-site scripting...

CVE-2018-5667

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationpattern parameter...

CVE-2018-5668

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationtitle parameter...

PT-2018-17067

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1 Description: A security issue was found in the read-and-understood plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the rnu username validation title parameter in the...

PT-2018-17066

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1 Description: A security issue exists in the read-and-understood plugin for WordPress, where cross-site scripting XSS is possible. This occurs via the "wp-admin/options-general.php" endpoint, specifically...

About User Enumeration

User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user...

ntop-ng 2.5.160805 - Username Enumeration Exploit

Exploit for multiple platform in category web applications Exploit title: ntopng user enumeration Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 04-08-2016 Vendor homepage: ntop.org Software version: v.2.5.160805 !/usr/env/python import os import sys import urllib import urllib2 impo...

CVE-2016-4745

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...

The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.

The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...

PCS pcsd competitive conditions loophole

PCS is a set of tools for configuring and managing Pacemaker and Corosync clustering software using the command line and web UI. A competitive condition vulnerability exists in PCS 0.9.139 and prior versions of pcsd that stems from the program's use of global variables to validate usernames. A...

CVE-2009-1273

pamssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

username not validated in add user to favourites action

Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...

username not validated in add user to favourites action

Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...

username not validated in add user to favourites action

Entering a bogus username here has the unwanted side effect of adding a bogus entity to your user favourites that can't be removed...

Design/Logic Flaw

OMEGA aka Omegasoft INterneSErvicesLosungen INSEL 7 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...