CWE-209

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the “create user” function. If a register/check/username?username= request corresponds to a username that exists, then an “is already in use” error is produced. NOTE: this product is discontinued.

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.

A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an “EMAIL DOES NOT EXIST” error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.

Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.