CVE-2023-27100

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests...

CVE-2023-27100

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests...

pfSense 安全漏洞

pfSense is a set of network firewalls based on FreeBSD Linux. A security vulnerability exists in Netgate pfSense Plus version v22.05.1 and pfSense CE version v2.6.0, which stems from an improper restriction on excessive authentication attempts, and can be exploited by an attacker to bypass the...

PT-2023-20955 · Netgate · Pfsense Ce +1

Name of the Vulnerable Software and Affected Versions: pfSense Plus software version 22.05.1 pfSense CE software version 2.6.0 Description: The issue is related to improper restriction of excessive authentication attempts in the SSHGuard component, allowing attackers to bypass brute force...

Missing brute force protection on password confirmation modal

None...

K36942191: Advanced WAF and BIG-IP ASM MySQL database vulnerability CVE-2021-23053

Security Advisory Description When the brute force protection feature of ASM/Adv WAF is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to lack of row limit on undisclosed tables in the MYSQL database. CVE-2021-23053...

K48321015: The BIG-IP Advanced WAF and ASM systems may fail to correctly enforce HTML form login pages

Security Advisory Description The BIG-IP Advanced WAF and ASM systems may fail to correctly enforce HTML form login pages when the request contains an incorrectly formatted parameter. This issue occurs when the security policy includes a configuration that enables brute force protection for the...

Lack of brute force protection

Issue Description • A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until an attacker discover the one correct combination that works. Steps to Reproduce: '1. First capture login request with BurpSuite,...

SUSE CVE-2020-1744

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

SUSE CVE-2021-32678

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller OCSController using the @BruteForceProtection annotation. Risk depends on the installed...

CVE-2023-24020

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login...

CVE-2023-24020

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login...

Design/Logic Flaw

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login...

CVE-2023-24020

CVE-2023-24020 affects Snap One Wattbox WB-300-IP-3; root cause: improper restriction of excessive authentication attempts (CWE-307). Affected: Wattbox WB-300-IP-3, versions WB10.9a17 and prior. Impact: could bypass brute-force protection and allow multiple login attempts, enabling credential gue...

CVE-2023-24020

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login...

CVE-2023-0581

The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it...

Nextcloud: Missing brute force protection on password confirmation modal

A vulnerability was found in Nextcloud that allowed an attacker to bypass password protection and view a user's current password in cleartext. This was possible due to a lack of rate limit on the endpoints for generating backup codes, deleting accounts, and updating profiles. The vulnerability wa...

Code injection

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts...

CVE-2022-38491

An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue...

CVE-2022-4097

The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...