Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker with the Manage Users permission can prevent legitimate users, including administrators, from accessing the platform by modifying usernames to cause account lockouts or username takeovers. Workaround...

GHSA-Q82V-H4RQ-5C86 Rancher update on users can deny the service to the admin

Impact A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically: - Username takeover: A user wit...

PT-2025-39663

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.12.2 Rancher versions prior to 2.11.6 Rancher versions prior to 2.10.10 Rancher versions prior to 2.9.12 Description A missing server-side validation on the .username field in Rancher allows users with update...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inodes xarray contention condition that could lead to a subvolume deletion lockout...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

CVE-2025-36064 affects IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0–3.1.0.22. The root cause is an inadequate account lockout setting that could permit a remote attacker to brute‑force credentials. IBM’s bulletin (and related sources) list a CVSS v3.1 base score of 5.9 (NEU...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

IBM Sterling Connect:Express for Microsoft Windows 安全漏洞

IBM Sterling Connect:Express for Microsoft Windows is a secure file transfer gateway software from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22, which stems from an insufficient account...

PT-2025-38985

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22 Description The software uses an inadequate account lockout setting. This could allow a remote attacker to attempt to brute force account credentials...

ROS-20250905-07

A vulnerability in the user locking mechanism of the Vault Enterprise and Vault Community Edition enterprise data archiving platforms is due to the application not performing the correct normalization of the application. Enterprise and Vault Community Edition is related to the fact that the...

Brute-force Attack

soosyze/soosyze is vulnerable to Brute-force Attack. The vulnerability is due to missing rate-limiting and account lockout mechanisms on the /user/login endpoint, which allows an attacker to repeatedly attempt logins and potentially gain unauthorized administrative access...

Linux Distros Unpatched Vulnerability : CVE-2022-30600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. CVE-2022-30600 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2021-38155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account...

Authentication Bypass

github.com/hashicorp/vault is vulnerable to Authentication Bypass. The vulnerability is due to improper enforcement of the user lockout feature due to flaws in the Userpass and LDAP authentication methods that allow lockout bypass...

Soosyze CMS 2.0 - Brute Force Login

Exploit Title: Soosyze CMS 2.0 - Brute Force Login Google Dork: N/A Date: 2025-08-13 Exploit Author: Beatriz Fresno Naumova beafn28 Vendor Homepage: https://soosyze.com/ Software Link: https://github.com/soosyze/soosyze Version: 2.0 tested Tested on: macOS Sonoma 14.x Apple Silicon M1, /bin/bash...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...