CVE-2017-7673

Apache OpenMeetings 1.0.0 is affected by CVE-2017-7673 due to weak cryptographic storage and missing brute-force protection in authentication-related forms, with registration and password-reset flows lacking captcha. Connected docs confirm the vulnerability details but do not provide a remediatio...

CVE-2017-7673

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection...

Western Digital TV Media Player Multiple critical vulnerabilities

Exploit for hardware platform in category web applications title: Multiple critical vulnerabilities product: Western Digital TV Media Player vulnerable version: 1.03.07 fixed version: - CVE number: - impact: Critical homepage: https://www.wdc.com found: 2017-01-17 by: Wan Ikram Office Kuala Lumpu...

WordPress Plugin All In One WP Security & Firewall Cross-Site Scripting

The first plugin that will be analyzed in detail is called All In One WP Security & Firewall. It adds some additional layers of security to Wordpress, for example a brute force protection for the login or file permission checks. There are definitely quite a lot of good ideas integrated into this...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

phpMyAdmin 4.3.x < 4.3.13.2 / 4.4.x < 4.4.14.1 reCaptcha Bypass (PMASA-2015-4)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.3.x prior to 4.3.13.2 or 4.4.x prior to 4.4.14.1. It is, therefore, affected by a security bypass vulnerability related to reCaptcha processing. An unauthenticated, remote attacker can...

Design/Logic Flaw

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha...

UBUNTU-CVE-2015-6830

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha...

CollabNet Subversion Edge missing brute force protection

Vuln Title: The CollabNet Subversion Edge does not protect against brute forcing accounts Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Lack of defensive measures Risk: Medium Status:...

Brute Force Protection Bypass in backend login

It has been discovered, that the backend login brute force protection can be bypassed Component Type: TYPO3 CMS Release Date: July 1, 2015 Vulnerable subcomponent: Backend Vulnerability Type: Brute Force Protection Bypass Affected Versions: Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 Severity: Low...

Bruteforce Attack Protection: sentry

Safe and effective protection against bruteforce attacks ssh, FTP, SMTP, and more Sentry detects and prevents bruteforce attacks against sshd using minimal system resources. Sentry does NOT make changes to your firewall configuration. It merely adds IPs to a table/list/chain. It does this...

CVE-2015-0994

Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests...

Design/Logic Flaw

Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests...

CVE-2015-0994

In Inductive Automation Ignition, CVE-2015-0994 impacts Ignition 7.7.2, where remote authenticated users can bypass the built-in brute-force protection by manipulating session ID values across a sequence of HTTP requests. The underlying issue involves session handling and credentials management t...

CVE-2015-0994

Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests...

Inductive Automation Ignition Security Bypass Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. A security vulnerability exists in the Ignition brute force attack blocking mechanism, which can be bypassed by an attacker by setting the session ID parameter in the HTTP request...

SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140710-0 ======================================================================= title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed...

Passera - Tool to generate strong unique passwords for each website

A simple tool that allows users to have strong unique passwords for each website, without the need to store them either locally or with an online service. It is available as a command-line tool for Linux/Mac/Windows and an Android app. Passera turns any entered text into a strong password up to 6...

Shopizer 1.1.5 Code Execution / XSS / CSRF / Data Manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed version: v...

Localize: No BruteForce Protection

A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works...