# CWE-204.

Every Advisory and CVE whose sources give the weakness CWE-204, newest first.

## Records, newest first (an older page)

- [nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy](https://agentprime.io/advisories/CVE-2024-6056.md)
  `CVE-2024-6056` · CVE record: nasirkhan Laravel Starter · CVSS 6.3 Medium · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-204
- [IBM i information disclosure](https://agentprime.io/advisories/CVE-2024-31870.md)
  `CVE-2024-31870` · CVE record: IBM i · CVSS 3.3 Low · Not analysed yet · Published 15 Jun 2024 · Tags: CWE-204
- [An issue was discovered in Logpoint before 7.4.0.](https://agentprime.io/advisories/CVE-2024-33856.md)
  `CVE-2024-33856` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: CWE-204
- [IBM Aspera Orchestrator information disclosure](https://agentprime.io/advisories/CVE-2023-27283.md)
  `CVE-2023-27283` · CVE record: IBM Aspera Orchestrator · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2024 · Tags: CWE-204
- [IBM Cognos Controller information disclosure](https://agentprime.io/advisories/CVE-2021-20556.md)
  `CVE-2021-20556` · CVE record: IBM Cognos Controller · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: CWE-204
- [CasaOS Username Enumeration - Bypass of CVE-2024-24766](https://agentprime.io/advisories/GHSA-hcw2-2r9c-gc6p.md)
  `GHSA-hcw2-2r9c-gc6p`, `CVE-2024-28232`, `GO-2024-2668` · Go `github.com/IceWhaleTech/CasaOS-UserService`: affected `>=0.4.7, <0.4.8`, fixed in `0.4.8` · CVSS 6.2 Medium · Not analysed yet · Published 1 Apr 2024 · Tags: CWE-204
- [Umbraco possible user enumeration](https://agentprime.io/advisories/GHSA-552f-97wf-pmpq.md)
  `GHSA-552f-97wf-pmpq`, `CVE-2024-28868` · NuGet `UmbracoCMS`: affected `>=10.0.0, <10.8.5`, fixed in `10.8.5` · CVSS 3.7 Low · Not analysed yet · Published 20 Mar 2024 · Tags: Information disclosure, CWE-204
- [Observable Response Discrepancy at Alma Devklan Blog](https://agentprime.io/advisories/CVE-2024-1145.md)
  `CVE-2024-1145` · CVE record: Devklan Alma Blog · CVSS 5.3 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-204
- [Surya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancy](https://agentprime.io/advisories/CVE-2024-2482.md)
  `CVE-2024-2482` · CVE record: Surya2Developer Hostel Management Service · CVSS 3.7 Low · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-204
- [IBM DS8900F information disclosure](https://agentprime.io/advisories/CVE-2023-46170.md)
  `CVE-2023-46170` · CVE record: IBM DS8900F · CVSS 6.5 Medium · Not analysed yet · Published 7 Mar 2024 · Tags: CWE-204
- [CasaOS Username Enumeration](https://agentprime.io/advisories/GHSA-c967-2652-gfjm.md)
  `GHSA-c967-2652-gfjm`, `CVE-2024-24766`, `GO-2024-2615` · Go `github.com/IceWhaleTech/CasaOS-UserService`: affected , fixed in `0.4.7` · CVSS 6.2 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-204
- [IBM CICS TX information disclosure](https://agentprime.io/advisories/CVE-2023-38362.md)
  `CVE-2023-38362` · CVE record: IBM CICS TX Advanced · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-204
- [IBM Common Licensing information disclosure](https://agentprime.io/advisories/CVE-2023-50306.md)
  `CVE-2023-50306` · CVE record: IBM Common Licensing · CVSS 4.0 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-204
- [Liferay Portal allows attackers to discover the existence of sites](https://agentprime.io/advisories/GHSA-mqf8-4cqm-p83x.md)
  `GHSA-mqf8-4cqm-p83x`, `CVE-2024-25146` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.3.0, <7.3.10.u4 || >=7.2.0, <7.2.10.fp18`, fixed in `7.3.10.u4`, `7.2.10.fp18` · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Information disclosure, CWE-204
- [An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable.](https://agentprime.io/advisories/CVE-2023-23584.md)
  `CVE-2023-23584` · CVE record: Gallagher Command Centre Server · CVSS 4.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-204
- [An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.](https://agentprime.io/advisories/CVE-2023-37831.md)
  `CVE-2023-37831` · CVE record · No CVSS score · Not analysed yet · Published 31 Oct 2023 · Tags: CWE-204
- [User enumeration vulnerability in Fujitsu Arconte Áurea](https://agentprime.io/advisories/CVE-2023-4095.md)
  `CVE-2023-4095` · CVE record: Fujitsu Arconte Áurea · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-204
- [Piccolo's current \`BaseUser.login\` implementation is vulnerable to time based user enumeration](https://agentprime.io/advisories/GHSA-h7cm-mrvq-wcfr.md)
  `GHSA-h7cm-mrvq-wcfr`, `CVE-2023-41885`, `PYSEC-2023-173` · PyPI `piccolo`: affected `<0.121.0`, fixed in `0.121.0` · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2023 · Tags: Information disclosure, CWE-204
- [User enumeration vulnerability in Roundcube Password Recovery Plugin](https://agentprime.io/advisories/CVE-2023-3221.md)
  `CVE-2023-3221` · CVE record: AlfnRU Password Recovery Plugin · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2023 · Tags: CWE-204
- [Silverware Games vulnerable to account enumeration via inconsistent responses](https://agentprime.io/advisories/CVE-2023-40179.md)
  `CVE-2023-40179` · CVE record: mesosoi silverwaregames-io-issue-tracker · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2023 · Tags: CWE-204
- [Sulu Observable Response Discrepancy on Admin Login](https://agentprime.io/advisories/GHSA-wmwf-49vv-p3mr.md)
  `GHSA-wmwf-49vv-p3mr`, `CVE-2023-39343`, `PKSA-h98d-hq46-k9cs` · Packagist `sulu/sulu`: affected `>=2.5.0, <2.5.10`, fixed in `2.5.10` · CVSS 4.3 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-204
- [Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2023-37217.md)
  `CVE-2023-37217` · CVE record: Tadiran Telecom Aeonix · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2023 · Tags: CWE-204
- [SICK AG ICR890-4: Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to…](https://agentprime.io/advisories/CVE-2023-35698.md)
  `CVE-2023-35698` · CVE record: SICK AG ICR890-4 · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-204
- [TN-5900 Series User Enumeration Vulnerability](https://agentprime.io/advisories/CVE-2023-3336.md)
  `CVE-2023-3336` · CVE record: Moxa TN-5900 Series · CVSS 5.3 Medium · Not analysed yet · Published 5 Jul 2023 · Tags: CWE-204
- [Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2023-31186.md)
  `CVE-2023-31186` · CVE record: Avaya IX Workforce Engagement · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2023 · Tags: CWE-204
- [Snap One OvrC Cloud: When supplied with a random MAC address…](https://agentprime.io/advisories/CVE-2023-28412.md)
  `CVE-2023-28412` · CVE record: Snap One OvrC Cloud · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2023 · Tags: CWE-204
- [Teltonika Remote Management System: Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that…](https://agentprime.io/advisories/CVE-2023-32346.md)
  `CVE-2023-32346` · CVE record: Teltonika Remote Management System · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2023 · Tags: CWE-204
- [Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid us…](https://agentprime.io/advisories/CVE-2023-23449.md)
  `CVE-2023-23449` · CVE record: SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 May 2023 · Tags: CWE-204
- [Siemens Mendix Forgot Password (Mendix 7 compatible): A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All…](https://agentprime.io/advisories/CVE-2023-27464.md)
  `CVE-2023-27464` · CVE record: Siemens Mendix Forgot Password (Mendix 7 compatible) and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: CWE-204
- [vantage6 vulnerable to Observable Response Discrepancy](https://agentprime.io/advisories/GHSA-36gx-9q6h-g429.md)
  `GHSA-36gx-9q6h-g429`, `CVE-2022-39228`, `PYSEC-2023-313`, `PYSEC-2023-52` · PyPI `vantage6`: affected `<3.8.0`, fixed in `3.8.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Feb 2023 · Tags: Information disclosure, CWE-204
- [A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.](https://agentprime.io/advisories/CVE-2022-41697.md)
  `CVE-2022-41697` · CVE record: Ghost Foundation Ghost · CVSS 5.3 Medium · EPSS 0.20 · Not analysed yet · Published 23 Dec 2022 · Tags: CWE-204
- [Kirby CMS vulnerable to user enumeration in the brute force protection](https://agentprime.io/advisories/GHSA-c27j-76xg-6x4f.md)
  `GHSA-c27j-76xg-6x4f`, `CVE-2022-39315`, `PKSA-5k7b-5skk-nstj` · Packagist `getkirby/cms`: affected `<3.5.8.2 || >=3.6.0, <3.6.6.2 || >=3.7.0, <3.7.5.1 || >=3.8.0, <3.8.1`, fixed in `3.5.8.2`, `3.6.6.2`, `3.7.5.1`, `3.8.1` · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2022 · Tags: Information disclosure, CWE-204
- [Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms](https://agentprime.io/advisories/GHSA-43qq-qw4x-28f8.md)
  `GHSA-43qq-qw4x-28f8`, `CVE-2022-39314`, `PKSA-7256-97xt-6n1p` · Packagist `getkirby/cms`: affected `>=3.5.0, <3.5.8.2 || >=3.6.0, <3.6.6.2 || >=3.7.0, <3.7.5.1 || >=3.8.0, <3.8.1`, fixed in `3.5.8.2`, `3.6.6.2`, `3.7.5.1`, `3.8.1` · CVSS 4.8 Medium · Not analysed yet · Published 18 Oct 2022 · Tags: Authentication bypass, CWE-204
- [CCURE Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2021-36201.md)
  `CVE-2021-36201` · CVE record: Johnson Controls C•CURE 9000 · CVSS 4.3 Medium · Not analysed yet · Published 11 Oct 2022 · Tags: CWE-204
- [User enumeration vulnerability in MB connect line and Helmholz products](https://agentprime.io/advisories/CVE-2022-22520.md)
  `CVE-2022-22520` · CVE record: MB connect line mymbCONNECT24 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2022 · Tags: CWE-204
- [CODESYS Visualization vulnerable to user enumeration](https://agentprime.io/advisories/CVE-2022-1989.md)
  `CVE-2022-1989` · CVE record: CODESYS CODESYS Visualization · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2022 · Tags: CWE-204
- [SUMA user enumeration via weak error message](https://agentprime.io/advisories/CVE-2022-31248.md)
  `CVE-2022-31248` · CVE record: SUSE SUSE Manager Server 4.1 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2022 · Tags: CWE-204
- [Qlik Sense Enterprise Domain User enumeration](https://agentprime.io/advisories/CVE-2022-0564.md)
  `CVE-2022-0564` · CVE record: Qlik Sense Qlik Sense Enterprise on Windows · CVSS 5.3 Medium · Not analysed yet · Published 21 Feb 2022 · Tags: CWE-204
- [Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)](https://agentprime.io/advisories/GHSA-q9x4-q76f-5h5j.md)
  `GHSA-q9x4-q76f-5h5j`, `CVE-2019-19030`, `GO-2022-0704` · Go `github.com/goharbor/harbor`: affected `>=1.7.0, <1.10.3 || >=2.0.0, <2.0.1`, fixed in `1.10.3`, `2.0.1` · CVSS 5.3 Medium · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-204
- [Observable Response Discrepancy in Flask-AppBuilder](https://agentprime.io/advisories/GHSA-wfjw-w6pv-8p7f.md)
  `GHSA-wfjw-w6pv-8p7f`, `CVE-2022-21659`, `PYSEC-2022-24` · PyPI `flask-appbuilder`: affected `<3.4.4`, fixed in `3.4.4` · CVSS 5.3 Medium · Not analysed yet · Published 1 Feb 2022 · Tags: Information disclosure, CWE-204
- [SonicWall SMA100: A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated…](https://agentprime.io/advisories/CVE-2021-20049.md)
  `CVE-2021-20049` · CVE record: SonicWall SonicWall SMA100 · No CVSS score · Not analysed yet · Published 23 Dec 2021 · Tags: CWE-204
- [Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0](https://agentprime.io/advisories/CVE-2021-34580.md)
  `CVE-2021-34580` · CVE record: MB connect line mymbCONNECT24 and 1 more · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2021 · Tags: CWE-204
- [InHand Networks IR615 Router](https://agentprime.io/advisories/CVE-2021-38476.md)
  `CVE-2021-38476` · CVE record: InHand Networks IR615 Router · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-204
- [Observable Response Discrepancy in Lost Password Service](https://agentprime.io/advisories/GHSA-579x-cjvr-cqj9.md)
  `GHSA-579x-cjvr-cqj9`, `CVE-2021-39189`, `PKSA-mf7d-5516-2z87` · Packagist `pimcore/pimcore`: affected `<10.1.3`, fixed in `10.1.3` · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2021 · Tags: Information disclosure, CWE-204
- [Information Disclosure in Password Reset](https://agentprime.io/advisories/GHSA-347x-877p-hcwx.md)
  `GHSA-347x-877p-hcwx`, `BIT-typo3-2020-11063`, `CVE-2020-11063`, `PKSA-f4bv-c86k-p2bf`, `PKSA-mzh3-fprn-psqp` · Packagist `typo3/cms` and 1 more: affected `>=10.0.0, <10.4.2`, fixed in `10.4.2` · CVSS 3.7 Low · Not analysed yet · Published 13 May 2020 · Tags: Information disclosure, CWE-204
- [The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.](https://agentprime.io/advisories/CVE-2016-9499.md)
  `CVE-2016-9499` · CVE record: Accellion FTP Server · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-204

Newest: <https://agentprime.io/advisories/tag/cwe-204.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-204&cursor=WyIyMDI0LTA2LTI4VDE4OjM0OjQwLjc2OTAwMFoiLCJDVkUtMjAyNC0zODMyMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-204/?cursor=WyIyMDI0LTA2LTI4VDE4OjM0OjQwLjc2OTAwMFoiLCJDVkUtMjAyNC0zODMyMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.