CVE-2022-36781

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting...

DEBIAN-CVE-2021-42949

The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks...

HotelDruid 授权问题漏洞

HotelDruid is a hotel management system by the Digitaldruid.net team. The system includes features such as room management, financial management and inventory management. HotelDruid Hotel Management Software version v3.0.3 suffers from an authorization issue vulnerability that stems from the...

RHEL 8 : mailman:2.1 (RHSA-2021:4826)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4826 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

IHateToBudget 安全漏洞

IHateToBudget is a simple web application by the individual developer Bryton Lacquement in France. Used to understand and control your expenses. A security vulnerability exists in IHateToBudget v1.5.7 that stems from the use of a weak password policy that allows an attacker to potentially gain...

CVE-2022-36079 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...

Gitlab -- multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Content injection via Incidents Timeline description Lack of length validation in Snippets leads to Denial of Service Group IP allow-list not fully respected by the Package Registry Abusing Gitaly.GetTreeEntrie...

CVE-2022-36555

Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack...

Design/Logic Flaw

Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack...

CVE-2022-36555

Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack...

PT-2022-23464 · Hytec Inter · Hytec Inter Hwl-2511-Ss

Name of the Vulnerable Software and Affected Versions: Hytec Inter HWL-2511-SS versions 1.05 and below Description: The issue concerns the implementation of a SHA512crypt hash for the root account in the affected software, which can be easily cracked via a brute-force attack. Recommendations: For...

Ubuntu: Security Advisory (USN-868-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-XV7H-95R7-595J Incorrect implementation of lockout feature in Keycloak

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality...

CVE-2021-3513

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality...

CVE-2021-3513

CVE-2021-3513 affects Keycloak/Red Hat Single Sign-On; root cause is a wrong error message during credential entry that enables brute-force attempts even with permanent lockout. Impact is confidentiality. Connected docs confirm the issue and reference security advisories, but do not provide expli...

Default credentials

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

CVE-2022-2822 Authentication Bypass by Primary Weakness in octoprint/octoprint

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

CVE-2022-37401 Apache OpenOffice Weak Master Keys

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from...

Design/Logic Flaw

A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts...

PT-2022-16724 · Red Hat · Red Hat Process Automation Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Process Automation Manager version 7 Description: A flaw was found in the software where an attacker can benefit from a brute force attack against the Administration Console, as the application does not limit the number of unsuccessfu...