Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

CVEs (186)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-20049 1Sonicwall 6Sma 100 Firmware Sma 200 FirmwareSma 210 Firmware+3 more Jun 17, 2026 Dec 23, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37...Show more A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.Show less
CVE-2021-34580 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Oct 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
CVE-2021-38476 1Inhandnetworks 1Ir615 Firmware Jun 17, 2026 Oct 19, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts.
CVE-2021-39189 1Pimcore 1Pimcore Jun 17, 2026 Sep 15, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a worka...Show more Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.Show less
CVE-2020-11063 1Typo3 1Typo3 Jun 17, 2026 May 13, 2020 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on emai...Show more In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.Show less
CVE-2016-9499 1Accellion 1Ftp Server Nov 21, 2024 Jul 13, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Previous 1...6 7 8 910