Design/Logic Flaw

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users...

CVE-2016-9124

Revive Adserver prior to 3.2.3 is affected by improper restriction of excessive authentication attempts on the login page, enabling password-guessing attacks. The issue stems from login controls that do not adequately throttle/brute-force limit, though a random delay and anti-parallel brute-forci...

CVE-2016-8347

An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method...

Moxa NPort Device Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-336-02 Moxa NPort Device Vulnerabilities that was published December 1, 2016, on the NCCIC/ICS-CERT web site. Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp have identifie...

Kabona AB WDC Brute Force Decryption Vulnerability

Kabona AB WDC is a web-based SCADA system from the Swedish company Kabona AB. A security vulnerability exists in Kabona AB WDC versions prior to 3.4.0, which stems from the program failing to limit the number of authentication attempts. An attacker could exploit this vulnerability to conduct a...

Beckhoff Embedded PC Image and Automation Device Specification TwinCAT Component Security Bypass Vulnerability

Beckhoff Embedded PC Images and Automation Device Specification ADS TwinCAT Components are Beckhoff products for critical infrastructure applications in manufacturing, energy and wastewater systems. Beckhoff Embedded PC Images is a functionally configurable industrial control system for...

CVE-2014-5414

Beckhoff Embedded PC Images (pre-2014-10-22) and Automation Device Specification (ADS) TwinCAT components expose an authentication-bruteforce risk due to not limiting login attempts. This remote vulnerability could allow unauthorized access via brute-force over ADS-related services. Affected buil...

Vulnerability of the microprogramming software of the Onecell G3100v2 and Onecell G3001 modems, allowing a intruder to gain access to the device

The vulnerability of the microprogrammed software of the Onecell G3100v2 and Onecell G3001 modems lies in the improper limitation on the number of authentication attempts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device through a...

WN-GDN/R3 Series does not limit authentication attempts

Overview WN-GDN/R3 Series provided by I-O DATA DEVICE, INC. does not limit authentication attempts. WN-GDN/R3 series provided by I-O DATA DEVICE, INC. is a wireless LAN router. WPS functionality in WN-GDN/R3 Series does not limit PIN authentication attempts, making it susceptible to brute force...

OpenSSH Keyboard Cross Validation Brute Force Vulnerability

OpenSSH is an open source implementation of the SSH protocol. A security vulnerability in the OpenSSH implementation with keyboard interaction turned on allows an attacker to bypass the MaxAuthTries limit and perform brute-force breaking attacks...

CVE-2013-4965

Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...

CVE-2011-4022

The sensor in Cisco Intrusion Prevention System IPS 7.0 and 7.1 allows remote attackers to cause a denial of service file-handle exhaustion and mainApp hang by making authentication attempts that exceed the configured limit, aka Bug ID CSCto51204...

Microsoft SMB NTLM Authentication Lack of Entropy (MS10-012; CVE-2010-0231)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. An elevation of privilege vulnerability has been reported in the way that Microsoft Server Message Block SMB Protocol software handles authentication attempts. The vulnerability is due to a lack of...

Design/Logic Flaw

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux RHEL 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks...

older vsftpd authentication memory leak

Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux RHEL 3 and 4, when PAM is used, allows remote attackers to cause a denial of service memory consumption via a large number of invalid authentication attempts within the same session, a different...

CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...

Authentication flaw

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...

CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...

DEBIAN-CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...

CVE-2007-5686

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging...