1733 matches found
CVE-2023-2060
CVE-2023-2060 affects Mitsubishi Electric MELSEC iQ-R Series RJ71EIP91 and iQ-F FX5-ENET/IP Ethernet/IP modules. The flaw is an authentication bypass via FTP caused by weak password requirements, enabling remote, unauthenticated access through dictionary attacks or password sniffing. Public discl...
CVE-2023-2060 Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or passwo...
CVE-2023-29736
Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution...
CVE-2023-29736
Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution...
PT-2023-22387 · Unknown · Keyboard Themes
Name of the Vulnerable Software and Affected Versions: Keyboard Themes version 1.275.1.164 Description: The issue allows unauthorized apps to overwrite arbitrary files in the internal storage of Keyboard Themes and achieve arbitrary code execution due to a dictionary traversal vulnerability...
CVE-2023-29736
CVE-2023-29736 affects Keyboard Themes for Android, version 1.275.1.164. A dictionary traversal vulnerability allows unauthorized apps to overwrite arbitrary files in internal storage and achieve arbitrary code execution. Multiple sources summarize impacts to confidentiality, integrity, and avail...
Timmystudios Fast Typing Keyboard 路径遍历漏洞
Timmystudios Fast Typing Keyboard is an Android app keyboard by Timmystudios. A security vulnerability exists in Timmystudios Fast Typing Keyboard Themes version 1.275.1.164, which stems from the presence of a dictionary traversal vulnerability that could allow an unauthorized application to...
Brute-Forcing a Fingerprint Reader
Its neither hard nor expensive: Unlike password authentication, which requires a direct match between what is inputted and whats stored in a database, fingerprint authentication determines a match using a reference threshold. As a result, a successful fingerprint brute-force attack requires only...
Oracle Linux 8 : freeradius:3.0 (ELSA-2023-2870)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2870 advisory. 3.0.20-14 - Fix defect found by Covscan Resolves: 2151704 3.0.20-13 - Fix multiple CVEs - Add rpminspect configuration Resolves: 2151702 Resolves:...
SUSE CVE-2023-32251
A vulnerability has been identified in the Linux kernel's ksmbd component kernel SMB/CIFS server. A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the...
freeradius: Information leakage in EAP-PWD
In freeradius, the EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack...
Debian dla-3424 : pypy-ipaddress - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3424 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3424-1 [email protected] https://www.debian.org/lts/security/...
AlmaLinux 9 : freeradius (ALSA-2023:2166)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2166 advisory. - In freeradius, the EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to substantially reduce the siz...
freeradius: Information leakage in EAP-PWD
In freeradius, the EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack...
freeradius: Crash on unknown option in EAP-SIM
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash...
PT-2023-20806
Name of the Vulnerable Software and Affected Versions wangmarket CMS version 4.10 Description The issue allows remote attackers to run arbitrary SQL commands via the TableName parameter to the "/plugin/dataDictionary/tableView.do" API endpoint. This enables attackers to manipulate database querie...
CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...
Design/Logic Flaw
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document xmlDictComputeFastKey in dict.c can produce non-deterministic values leading to various logic and memory errors such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string and any value is possible (not solely the '\0' value).
...
PingID Adapter 加密问题漏洞
PingID Adapter is a middleware for authentication and access control from Ping Identity. A security vulnerability exists in PingID Adapter that stems from the vulnerability of offline MFA to pre-computed dictionary attacks, which can lead to offline MFA being bypassed...