Authentication flaw

The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication...

CVE-2023-33868

CVE-2023-33868 concerns an authentication flaw in PiiGAB M-Bus software (notably the 900S family). The root issue is an unlimited number of login attempts, enabling brute-force against HTTP basic authentication. Public sources (NVD, CVE list, PRION, ics-advisory) consistently describe this vulner...

CVE-2023-33868: Improper Restriction of Excessive Authentication Attempts

The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication...

PT-2023-24522 · Piigab · M-Bus Softwarepack +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns the lack of limitation on the number of login attempts, which could allow an attacker to perform a brute force attack on HTTP basic...

CVE-2023-29168

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

CVE-2023-29168

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

Design/Logic Flaw

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

CVE-2023-29168

CVE-2023-29168 affects PTC Vuforia Studio: the local Vuforia web application does not support HTTPS and federated credentials are passed via basic authentication, exposing credentials. Affected products: Vuforia Studio all versions prior to 9.9. According to the ICS advisory, it is exploitable re...

CVE-2023-29168 PTC Vuforia Studio Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

CVE-2023-29168 PTC Vuforia Studio Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

Unauthenticated Blind SSRF

Description The Oxeye research team found Owncast vulnerable to an Unauthenticated Blind SSRF vulnerability. This vulnerability may allow an unauthenticated attacker to force the Owncast server to send HTTP requests to arbitrary locations using the GET HTTP method. This vulnerability also allows...

CVE-2023-29168: Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

PT-2023-22183

Name of the Vulnerable Software and Affected Versions Vuforia affected versions not specified Description The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication. Recommendations At the moment, there is no information about a newer...

SUSE CVE-2023-32319

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issu...

NextCloud security vulnerabilities

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in the Nextcloud server that stems from the lack of brute-force protection for WebDAV endpoints via the basic authentication header...

PT-2023-23726

Name of the Vulnerable Software and Affected Versions Nextcloud server versions 24.0.0 through 24.0.10 Nextcloud server versions 25.0.0 through 25.0.4 Nextcloud server versions prior to 26.0.0 Description The issue is related to missing brute-force protection on the WebDAV endpoints via the basic...

SUSE-SU-2023:0821-1 Security update for grafana

This update for grafana fixes the following issues: - CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step bsc1207749. - CVE-2022-39324: Fixed originalUrl spoof security issue bsc1207750. - CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding...

CVE-2023-23040: Use of a Broken or Risky Cryptographic Algorithm

TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication...

K20606443: iControl REST CSRF vulnerability CVE-2020-5922

Security Advisory Description iControl REST does not implement cross-site request forgery CSRF protections for users applying basic authentication in a web browser. CVE-2020-5922 Impact In a successful exploit, an attacker can run JavaScript in the context of the currently logged-in user. For an...

PT-2023-10262 · Harrystech · Harrystech Dynosaur-Rails

Name of the Vulnerable Software and Affected Versions: harrystech Dynosaur-Rails affected versions not specified Description: A critical vulnerability has been found in harrystech Dynosaur-Rails, affecting the basic auth function of the file app/controllers/application controller.rb. The...