CWE-204.

User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management

• SAP_SE SAP Financial Service Claims Management
• CWE-204

User Enumeration by excessive error output

• SICK AG Baggage Analytics
• SICK AG Tire Analytics
• CWE-204

Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs.

• CWE-204

Saleor has user enumeration vulnerability due to different error messages

• saleor
• CWE-204

Mautic Vulnerable to User Enumeration via Response Timing

• CWE-204

>=4.4.0, <4.4.17 || >=5.0.0-alpha, <5.2.8 || >=6.0.0-alpha, <6.0.5 · fixed in 4.4.17, 5.2.8, 6.0.5

Silverpeas Core Username Enumeration Vulnerability

• CWE-20
• CWE-204

>=6.4.1, <6.4.3 · fixed in 6.4.3

Portabilis i-Diario Password Recovery Endpoint email observable response discrepancy

• Portabilis i-Diario
• Information disclosure
• CWE-204

CWE-204: Observable Response Discrepancy

• Emby MediaBrowser
• CWE-204

OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

• OPEXUS FOIAXpress Public Access Link (PAL)
• CWE-204

Tuleap vulnerable to user enumeration via the lost password form

• Enalean tuleap
• CWE-204

HAXiam allows for User Enumeration

• haxtheweb issues
• CWE-204

CVE-2025-27451

• Endress+Hauser MEAC300-FNADE4
• CWE-204

MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24

• Helmholz myREX24
• Helmholz myREX24.virtual
• CWE-204

SinoTrack GPS Receiver Weak Authentication

• SinoTrack IOT PC Platform
• CWE-204

User enumeration

• SICK AG SICK Field Analytics
• CWE-204

IBM Security Verify Access information disclosure

• IBM Security Verify Access
• IBM Security Verify Access Docker
• CWE-204

Mautic allows user name enumeration due to response time difference on password reset form

• Information disclosure
• CWE-204

>=1.0.0, <4.4.16 || >=5.0.0-alpha, <5.2.6 || >=6.0.0-alpha, <6.0.2 · fixed in 4.4.16, 5.2.6, 6.0.2

Observable Response Discrepancy

• Tridium Niagara Framework
• Tridium Niagara Enterprise Security
• CWE-204

Observable Response Discrepancy

• Schweitzer Engineering Laboratories SEL-5056 Software-Defined Network Flow Controller
• CWE-204

Siemens Polarion V2310: A vulnerability has been identified in Polarion V2310 (All versions)…

• Siemens Polarion V2310
• Siemens Polarion V2404
• CWE-204

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

• CWE-204

<10.8.10 || >=11.0.0-rc1, <13.8.1 · fixed in 10.8.10, 13.8.1

A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests.

• Bosch Rexroth AG ctrlX OS - Device Admin
• CWE-204

Silverstripe Framework user enumeration via timing attack on login and password reset forms

• CWE-204

>=4.0.0, <5.3.23 · fixed in 5.3.23

Shopware 6 allows attackers to check for registered accounts through the store-api

• CWE-204

<6.5.8.18 || >=6.6.0.0, <6.6.10.3 || >=6.7.0.0-rc1, <6.7.0.0-rc2 · fixed in 6.5.8.18, 6.6.10.3, 6.7.0.0-rc2

Siemens Mendix Runtime V10: A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0)…

• Siemens Mendix Runtime V10
• Siemens Mendix Runtime V10.12
• CWE-204

IBM TXSeries for Multiplatforms information disclosure

• IBM TXSeries for Multiplatforms
• CWE-204

Zitadel allows User Enumeration by loginname attribute normalization

• zitadel
• Information disclosure
• CWE-204

User enumeration vulnerability in MeetMe products

• Fermax MeetMe
• CWE-204

User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancie…

• CWE-204

Flask-AppBuilder Observable Response Discrepancy

• CWE-204

<4.5.3 · fixed in 4.5.3

Q-Free MaxTime: A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than…

• Q-Free MaxTime
• CWE-204

Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

• SAP_SE SAP NetWeaver Server ABAP
• CWE-204

Pimcore Admin Classic Bundle allows user enumeration

• CWE-204

<1.7.4 · fixed in 1.7.4

IBM Aspera Faspex information disclosure

• IBM Aspera Faspex
• CWE-204

IBM Sterling File Gateway information disclosure

• IBM Sterling File Gateway
• CWE-204

IBM Control Center information disclosure

• IBM Control Center
• CWE-204

Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration

• AWS Sign-in IAM Login Flow
• CWE-204
• CWE-208

Cosmos userbase checking vulnerability

• azukaar Cosmos-Server
• CWE-204

Fortinet FortiClientEMS: An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0…

• Fortinet FortiClientEMS
• Fortinet FortiSOAR
• CWE-204

HCL MyXalytics is affected by username enumeration vulnerability

• HCL Software DRYiCE MyXalytics
• CWE-204

langhsu Mblog Blog System login observable response discrepancy

• langhsu Mblog Blog System
• Information disclosure
• CWE-204

Antabot White-Jotter login observable response discrepancy

• Antabot White-Jotter
• Information disclosure
• CWE-204

funnyzpc Mee-Admin Login login observable response discrepancy

• funnyzpc Mee-Admin
• Information disclosure
• CWE-204

Cisco Enterprise Chat and Email Username Enumeration Vulnerability

• Cisco Enterprise Chat and Email
• CWE-204

Django allows enumeration of user e-mail addresses

• Information disclosure
• CWE-204

<4.2.16 || >=5.0, <5.0.9 || >=5.1, <5.1.1 · fixed in 4.2.16, 5.0.9, 5.1.1

goTenna Pro ATAK Plugin Observable Response Discrepancy

• goTenna Pro ATAK Plugin
• CWE-204

Observable Response Discrepancy in goTenna Pro

• goTenna Pro
• CWE-204

Netcat CMS: user enumeration

• NetCat CMS
• CWE-204

Mautic allows users enumeration due to weak password login

• Information disclosure
• CWE-204

>=5.1.0, <5.1.1 · fixed in 5.1.1

User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password func…

• CWE-204

Siemens Mendix Runtime V10: A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only…

• Siemens Mendix Runtime V10
• Siemens Mendix Runtime V10.12
• CWE-204

Loway - CWE-204: Observable Response Discrepancy

• Loway QueueMetrics
• CWE-204

Answer has Observable Response Discrepancy in github.com/answerdev/answer

• CWE-204

<1.0.6 · fixed in 1.0.6

Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy

• Matrix Tafnit v8
• CWE-204

OpaMiddleware does not filter HTTP OPTIONS requests

• CWE-204

<2.0.1 · fixed in 2.0.1

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

• CWE-204

>=4.5.0, <4.9.0 · fixed in 4.9.0

IBM Security ReaQta information disclosure

• IBM Security QRadar EDR
• CWE-204

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.

• CWE-204

Information Disclosure of user names

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-204

IBM Storage Defender information disclosure

• IBM Storage Defender - Resiliency Service
• CWE-204