CVE-2022-3989 Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

PT-2022-25082 · WordPress · Motors

Name of the Vulnerable Software and Affected Versions: Motors WordPress plugin versions prior to 1.4.4 Description: The issue allows an attacker to upload malicious files, such as .php files, to a WordPress instance due to improper validation of uploaded files in an AJAX action. This can lead to...

Design/Logic Flaw

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

PT-2022-27339 · Seeddms · Seeddms

Name of the Vulnerable Software and Affected Versions: SeedDMS versions 5.1.7 through 6.0.20 Description: The issue is related to weak reset token generation, allowing attackers to execute a full account takeover via a brute force attack. Recommendations: For SeedDMS version 5.1.7, update to a...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-44938

The CVE-2022-44938 issue concerns SeedDMS v6.0.20 and v5.1.7, where weak reset token generation enables full account takeovers via brute force. According to sources (Red Hat, CNNVD/CVELIST, and vulnerability trackers), the vulnerability stems from insufficient randomness/verification in the accou...

CVE-2022-45482

Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

PT-2022-27538 · Unknown · Lazy Mouse Server

Name of the Vulnerable Software and Affected Versions: Lazy Mouse server affected versions not specified Description: The issue allows remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands due to weak password requirements and the lack of rate...

Authentication flaw

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...

CVE-2022-23746

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...

The vulnerability of the OATHAuth extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the OATHAuth extension, a software tool for implementing a hypertext environment like MediaWiki, relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to circumvent existing security measures through...

PT-2022-16247 · Check Point · Check Point Ipsec Vpn Blade

Name of the Vulnerable Software and Affected Versions: Check Point IPsec VPN blade affected versions not specified Description: The issue concerns a brute-force attack vulnerability when the IPsec VPN blade's portal is configured for username/password authentication, allowing attackers to target...

CVE-2022-23746

CVE-2022-23746 concerns brute-force vulnerability in the IPsec VPN blade SNX portal when configured for username/password authentication. The Red Hat, NVD, and other records consistently describe a credential-guessing flaw targeting the SNX portal; exploitation status is not detailed in the provi...

Check Point IPSec VPN 安全漏洞

Check Point IPSec VPN is a suite of VPN Virtual Private Network software based on the IPSec protocol from Check Point, Israel. Check Point IPSec VPN suffers from a security vulnerability that stems from susceptibility to brute force attacks on usernames and passwords...

Over 15,000 WordPress Sites Compromised in Malicious SEO Campaign

A new malicious campaign has compromised over 15,000 WordPress websites in an attempt to redirect visitors to bogus Q&A portals. "These malicious redirects appear to be designed to increase the authority of the attacker's sites for search engines," Sucuri researcher Ben Martin said in a report...

Security Bulletin: Vulnerability from Apache Kafka affect IBM Operations Analytics - Log Analysis (CVE-2021-38153)

Summary Apache Kafka is vulnerable to timing attacks that could allow remote attacker to obtain sensitive information Vulnerability Details CVEID:CVE-2021-38153 DESCRIPTION: Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a timing attack flaw due to the use o...

The vulnerability of the microprogramming software used in industrial LTE modems of the Moxa OnCell G3150A-LTE, OnCell G3470A-LTE, and WDR-3124A series, as well as the microprogramming software used in wireless access points for industrial systems of the Moxa AWK-3131A, AWK-4131A, AWK-1131A, and AWK-1137C models, stems from insufficient authentication attempts limits. This vulnerability allows attackers to execute a brute-force attack.

The vulnerability of the microprogramming software used in industrial LTE modems of the Moxa OnCell G3150A-LTE, OnCell G3470A-LTE, and WDR-3124A series, as well as the microprogramming software used in wireless access points for industrial systems of the Moxa AWK-3131A, AWK-4131A, AWK-1131A, and...

Information Disclosure

tripleoansible is vulnerable to Information Disclosure. The vulnerability exists due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted which allows an local attacker to use a brute force attack to explore the relevant directory and discover...

USN-5690-1 libxdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...