423 matches found
VPN SNX portal may be vulnerable to brute-force attack on passwords
Cause The VPN SNX portal in the IPsec VPN Software Blade does not implement any protection against brute-force attack on usernames/passwords. Symptoms - The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for...
Citrix ADC and Citrix Gateway 12.1.x < 12.1-65.21 / 13.0.x < 13.0-88.12 / 13.1.x < 13.1-33.47 Multiple Vulnerabilities (CTX463706)
The remote Citrix ADC or Citrix Gateway device is version 12.1.x prior to 12.1-65.21, 12.1-FIPS, prior to 12.1-55.289, 13.0.x prior to 13.0-88.12 or 13.1.x prior to 13.1-33.47. It may, therefore, be affected by multiple vulnerabilities, as follows: - User login brute force protection functionalit...
CVE-2022-27516
User login brute force protection functionality bypass...
CVE-2022-27516
CVE-2022-27516 describes a bypass of the login brute-force protection in Citrix Gateway/ADC. Affected products/versions per CTX463706: Citrix ADC/Gateway 12.1.x before 12.1-65.21 (12.1-65.21 included in FIPS/NDcPP), 13.0.x before 13.0-88.12, 13.1.x before 13.1-33.47 (also 12.1-FIPS before 12.1-55...
CVE-2022-27516 User login brute force protection functionality bypass
User login brute force protection functionality bypass...
CVE-2022-27516 User login brute force protection functionality bypass
User login brute force protection functionality bypass...
Citrix Gateway and Citrix ADC Security Bulletin for CVE-2022-27510 CVE-2022-27513 and CVE-2022-27516
Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy are affected by the first issue, which is rated as a Critical severity vulnerability. CVE-ID| Description| CWE| Affect...
PT-2022-18465 · Citrix · Access Gateway +3
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns a bypass of the user login brute force protection functionality. Recommendations: At the moment, there is no information about a newer version that contains a fix for...
CVE-2022-39315 Kirby CMS vulnerable to user enumeration in the brute force protection
Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does...
Kirby CMS vulnerable to user enumeration in the brute force protection
TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. ---- Introduction User enumeration is a type of vulnerability that allows...
GHSA-C27J-76XG-6X4F Kirby CMS vulnerable to user enumeration in the brute force protection
TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. ---- Introduction User enumeration is a type of vulnerability that allows...
CVE-2022-35490
Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this prevention, enabling them to send more...
Missing rate limit when trying to join a password protected Nextcloud Talk conversation
None...
CVE-2022-31118 Missing brute force protection on cloud federation sharing in Nextcloud Server
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares a-zA-Z0-9 ^ 15. It is recommended that the Nextcloud Server is upgraded t...
CVE-2022-31118 Missing brute force protection on cloud federation sharing in Nextcloud Server
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares a-zA-Z0-9 ^ 15. It is recommended that the Nextcloud Server is upgraded t...
Ransomware protection with Malwarebytes EDR: Your FAQs, answered!
We get a few questions about ransomware protection and how our Endpoint Detection and Response software can protect you from ransomware. In this post, our security experts answer some of your most frequently asked questions about ransomware and how our EDR can help--lets get started. Q: When...
Missing brute force protection on cloud federation sharing
None...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible combination without any restriction. Proof of Concept 1. 1 - Send a login request of the target user POST /api/auth/token HTTP/1.1 Host: localhost:9091...
Simplifying the fight against ransomware: An expert explains
Fighting against ransomware can be difficult—especially if your organization has limited IT resources to begin with. But Adam Kujawa, security evangelist and director of Malwarebytes Labs, has a few tips for overburdened IT folks looking to simplify their fight against ransomware. In this post,...
Nextcloud: Lack of Brute force protection while joining video call in talk section which is password protected
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq...