Overview 221 matches · 4 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 6 public PoC · 0 EPSS ≥ 0.5
221matches
4in Waratek scope1.8%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
6public PoC2.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4
1.8%
Outside Waratek scope
2
0.9%
Not applicable
215
97.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
221
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
5
2.3%
Proof of concept only
43
19.5%
Forecast only
0
0.0%
No public exploit
173
78.3%
split by
peak 105 / year
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20190
20201
Not applicable1
Low1
not blocked1
No public exploit1
20214
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20228
Not applicable8
Medium8
not blocked8
Working exploit published1
Proof of concept only1
No public exploit6
202317
Not applicable17
Medium17
not blocked17
Proof of concept only2
No public exploit15
202430
No exploit published1
Outside Waratek scope1
Not applicable28
High5
Medium23
Low2
not blocked30
Proof of concept only10
No public exploit20
202555
No exploit published1
Not applicable54
High5
Medium46
Low4
not blocked55
Proof of concept only9
No public exploit46
2026105
No exploit published2
Outside Waratek scope1
Not applicable102
Critical5
High10
Medium80
Low10
not blocked105
Working exploit published4
Proof of concept only21
No public exploit80
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-31186 | Medium | 2023-05-30 | Not applicable | No public exploit | Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy |
| CVE-2023-32346 | Medium | 2023-05-22 | Not applicable | No public exploit | Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the serial number of a device has already been claimed, the MAC address of a device has already been claimed, or whether the attempt to claim a device was successful. An attacker could exploit this to create a list of the serial numbers and MAC addresses of all devices cloud-connected to the Remote Management System. |
| CVE-2023-28412 | Medium | 2023-05-22 | Not applicable | No public exploit | When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information. |
| CVE-2023-23449 | Medium | 2023-05-15 | Not applicable | No public exploit | Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames by analyzing challenge responses from the server via the REST interface. |
| CVE-2023-27464 | Medium | 2023-04-11 | Not applicable | No public exploit | A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information. |
| CVE-2023-1540 | Medium | 2023-03-21 | Not applicable | Proof of concept only | Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
| CVE-2022-39228 | Medium | 2023-03-01 | Not applicable | No public exploit | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0. |
| CVE-2019-19030 | Medium | 2022-12-26 | Not applicable | Proof of concept only | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists. |
| CVE-2022-41697 | Medium | 2022-12-22 | Not applicable | Working exploit published | A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability. |
| CVE-2022-39315 | Medium | 2022-10-25 | Not applicable | No public exploit | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned releases, the maintainers have rewritten the affected code so that the delay is also inserted after the brute force limit is reached. |
| CVE-2021-36201 | Medium | 2022-10-11 | Not applicable | No public exploit | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
| CVE-2022-22520 | Medium | 2022-09-14 | Not applicable | No public exploit | A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. |
| CVE-2022-1989 | Medium | 2022-08-23 | Not applicable | No public exploit | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users. |
| CVE-2022-31248 | Medium | 2022-06-22 | Not applicable | No public exploit | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1. |
| CVE-2022-0564 | Medium | 2022-02-21 | Not applicable | No public exploit | A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured. The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists. |
| CVE-2021-20049 | High | 2021-12-23 | Not applicable | No public exploit | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions. |
| CVE-2021-34580 | High | 2021-10-27 | Not applicable | No public exploit | In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts. |
| CVE-2021-38476 | Medium | 2021-10-19 | Not applicable | No public exploit | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts. |
| CVE-2021-39189 | Medium | 2021-09-15 | Not applicable | No public exploit | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually. |
| CVE-2020-11063 | Low | 2020-05-13 | Not applicable | No public exploit | In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2. |
| CVE-2016-9499 | Medium | 2018-07-13 | Not applicable | No public exploit | Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them. |