2779 matches found
PT-2022-22867 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows for privilege escalation. Zammad has a mechanism to prevent brute-force attacks by invalidating users after a configurable number of attempts to guess login credentials. However, an attacker...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1- Send a login request of the target user POST http://localhost:5000/api/account/login...
Account Takeover [namelessmc.com]
Description: 1. Hello team, while i was testing on https://namelessmc.com/login/ i noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field Steps to reproduce: 1. 1- go to https://namelessmc.com/login/ 2. 2- Ente...
CVE-2022-35143
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks...
Renato 安全漏洞
Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0 that stems from the use of weak passwords, which can be exploited by an attacker to crack a user's password via a brute-force...
LibreOffice < 7.2.7 / 7.3 < 7.3.3 Multiple Vulnerabilities (macOS)
According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.3. It is, therefore, affected by multiple vulnerabilities: - LibreOffice supports the storage of passwords for web connections in the user's configuration database. The stored...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1 - Send a login request of the target user POST http://localhost:3000/api/access-tokens...
BookWyrm 授权问题漏洞
BookWyrm is a social reading platform. Versions of BookWyrm prior to 0.4.5 suffer from an authorization issue vulnerability that stems from its lack of rate limiting for authentication views, leading to allowing an attacker to perform a brute force cracking attack...
PT-2022-23296 · Bf-Os · Bf-Os
Name of the Vulnerable Software and Affected Versions: BF-OS versions 3.x up to and including 3.83 Description: The issue allows a remote attacker to brute-force the device password due to the lack of strong password enforcement. Recommendations: For BF-OS versions 3.x up to and including 3.83,...
CVE-2022-26307
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...
CVE-2022-26307
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...
Design/Logic Flaw
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
Design/Logic Flaw
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451 Insecure Randomness
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
CVE-2021-23451
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...
PT-2022-9398 · Unknown · Otp-Generator
Name of the Vulnerable Software and Affected Versions: otp-generator versions prior to 3.0.0 Description: The issue is related to insecure randomness in the generation of one-time passwords, which could potentially allow a brute-force attack. Recommendations: For versions prior to 3.0.0, update t...
CVE-2022-26307
CVE-2022-26307 affects LibreOffice: the weakness arises from how the master key/IV is encoded for web-connection passwords, reducing entropy from 128 to 43 bits. Affected: The Document Foundation LibreOffice 7.2 before 7.2.7 and 7.3 before 7.3.3. Impact: stored web passwords in the user configura...
CVE-2022-26307
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...