CVE-2022-39314 User enumeration in the code-based login and password reset forms

Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the code or password-reset auth method with the...

Take over of AdminRole contract

Lines of code Vulnerability details Impact Any user can call the grantAdmin or revokeAdmin method and take control of the contract. Proof of Concept The grantAdmin and revokeAdmin methods are not protected by any type of authentication restriction, when they should have the onlyAdmin modifier. So...

CVE-2022-2321

Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...

CVE-2022-22810

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous attempts at guessing credentials. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX formerly homeLYnk V2.6.2 and prior, fellerLYn...

PT-2022-9072 · Schlage +1 · Schlage Be468 +1

Name of the Vulnerable Software and Affected Versions: Z-Wave devices based on Silicon Labs 500 series chipsets Schlage BE468 version 3.42 Description: The issue affects Z-Wave devices that use S0 authentication, leading to uncontrolled resource consumption and resulting in battery exhaustion. Fo...

JetBrains Hub 授权问题漏洞

JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An authentication restriction mechanism bypass vulnerability exists in JetBrains Hub versions prior to 2021.1.13690. An attacker ca...

Input validation

Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network...

Huawei HedEx Lite (DM) Path Traversal

Document Title: =============== Huawei HedEx Lite DM - Path Traversal Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2268 Release Date: ============= 2020-11-24 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2017-7915

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions,...

subversion: multiple issues

CVE-2016-2167 authentication restriction bypass The canonicalizeusername function in svnserve/cyrusauth.c, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm...

Authentication Flaw in PayPal mobile API Allows Access to Blocked Accounts

.jpg Payment services provider PayPal is vulnerable to an authentication restriction bypass vulnerability, which could allow an attacker to bypass a filter or restriction of the online-service to get unauthorized access to a blocked users’ PayPal account. The security vulnerability actually resid...

CVE-2012-4613

EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentication attempts by a user account, which makes it easier for local users to bypass intended access restrictions via a brute-force attack...