CVE-2006-6682

Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system.

• CWE-388

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454Third Party Advisory
• http://marc.info/?l=bugtraq&m=116371297325564&w=2Mailing List
• http://secunia.com/advisories/22967Permissions Required, Third Party Advisory
• http://www.osvdb.org/30545Broken Link, Permissions Required, Third Party Advisory
• http://www.securityfocus.com/bid/21102Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30454VDB Entry
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454Third Party Advisory
• http://marc.info/?l=bugtraq&m=116371297325564&w=2Mailing List
• http://secunia.com/advisories/22967Permissions Required, Third Party Advisory
• http://www.osvdb.org/30545Broken Link, Permissions Required, Third Party Advisory
• http://www.securityfocus.com/bid/21102Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30454VDB Entry

Published

Dec 21, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6676Integer overflow in the (a) OLE2 and (b) CHM parsers for ESE…
• CVE-2006-6677ESET NOD32 Antivirus before 1.1743 allows remote attackers t…
• CVE-2006-6678The edit_textarea function in form-file.c in Netrik 1.15.4 a…
• CVE-2006-6679Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forw…7.5
• CVE-2006-6680Pedro Lineu Orso chetcpasswd before 2.3.1 does not document …
• CVE-2006-6681Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limi…
• CVE-2006-6683Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and …
• CVE-2006-6684Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd b…
• CVE-2006-6685Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2…
• CVE-2006-6686PHP remote file inclusion vulnerability in sender.php in Car…
• CVE-2006-6687Cross-site scripting (XSS) vulnerability in Web Automated Pe…
• CVE-2006-6688Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Ne…