160 matches found
CVE-2026-102944
The cpp-httplib C++ header-only HTTP/HTTPS library is vulnerable to Cookie header leakage during cross-origin redirects. Prior to version 0.51.0 , the create_redirect_client() function fails to remove Cookie headers when following 301, 302, 307, or 308 redirect codes, unlike Host, Proxy-Authoriza...
CVE-2020-27747
CVE-2020-27747 Possible Account Takeover | Brute Force Ability Suggested description An issue was discovered in Click Studios Passwordstate 8.9 Build 8973. If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator 4 digits, a remote...
CVE-2026-103977
Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...
CVE-2026-13348
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled...
CVE-2026-13348
Schneider Electric PowerChute Serial Shutdown versions prior to 1.6 are affected by a CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability. When redirect handling is disabled , an attacker can perform an arbitrary number of authentication attempts over the network to g...
CVE-2026-13348: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled...
cve-lab-journal
CVE Lab Journal !CVEs loggedhttps://img.shields.io/badge/C...
Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint
Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...
PT-2026-75973
Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...
CVE-2026-7820: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts CWE-307 in pgAdmin 4. pgAdmin enforces MAXLOGINATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.initapp and is reachable on every server, never...
EUVD-2026-22288
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints...
CVE-2026-2402: Improper Restriction of Excessive Authentication Attempts
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints...
Authentication Lockout Bypass via Race Condition
...
Malicious code in elf-stats-peppermint-wishlist-307 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe62a90e39574207020ca4b713b10ebbc5f218dc93626332919f90826a58040b The package elf-stats-peppermint-wishlist-307 was found to contain malicious code...
EUVD-2025-202787
Malicious code in elf-stats-peppermint-wishlist-307 npm...
MAL-2025-192522 Malicious code in elf-stats-peppermint-wishlist-307 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe62a90e39574207020ca4b713b10ebbc5f218dc93626332919f90826a58040b The package elf-stats-peppermint-wishlist-307 was found to contain malicious code...
CVE-2025-11566: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint...
CVE-2025-60898
An unauthenticated server-side request forgery SSRF vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a...
CVE-2025-60898: Server-Side Request Forgery (SSRF)
An unauthenticated server-side request forgery SSRF vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a...