CVE-2023-40725

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Sep 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-407268.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive inforCVE-2023-407277.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak oCVE-2023-407287.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensCVE-2023-407297.4A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unCVE-2023-40738.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap cCVE-2023-407308.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks suffiCVE-2023-407318.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary filCVE-2023-407323.9A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not inCVE-2023-407357.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (ArchitectuCVE-2023-40748.8Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruCVE-2023-407439.8** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service tCVE-2023-407456.5LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly
CVE-2023-40725: Medium severity, CVSS 4.0 | Vulnix