GHSA-G84Q-CQ55-XWGP silverstripe/framework member disclosure in login form

There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue...

PT-2024-40294 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: Software affected versions not specified Description: The issue concerns a user ID enumeration vulnerability in brute force error messages. It allows an attacker to infer or confirm user details...

PT-2024-40248 · Unknown · Silverstripe

Name of the Vulnerable Software and Affected Versions: Silverstripe affected versions not specified Description: The issue concerns a user ID enumeration vulnerability in brute force error messages. Specifically, the system previously handled login attempts for non-existent and existing users...

CVE-2024-21791

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability...

PT-2024-19059 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL Injection in the lockout history option. Note that non-admin users cannot exploit this vulnerability. Recommendations: For versions below 7271, update to...

CVE-2024-3461

KioWare for Windows versions all through 8.35 allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number...

The vulnerability of the microprogrammed software of the MELSEC iQ-R Series Safety CPU and Series SIL2 Process CPU modules lies in the overly restrictive mechanism for blocking user accounts. This allows a malicious person to lock out the user account.

The vulnerability of the microprogrammed software of MELSEC iQ-R Series Safety CPUs and Series SIL2 Process CPUs is related to an overly restrictive mechanism for blocking user accounts. Exploiting this vulnerability could allow a malicious actor to lock out a user’s account by entering a known...

PT-2024-26025 · Unknown · Kioware For Windows

Name of the Vulnerable Software and Affected Versions: KioWare for Windows versions all through 8.35 Description: The issue allows for brute forcing the PIN number that protects the application from being closed, due to the lack of mechanisms preventing excessive guessing of the number...

CVE-2024-32868

CVE-2024-32868 affects ZITADEL and describes an improper lockout mechanism for MFA: there was no limit on (T)OTP verification attempts, enabling potential MFA bypass. The issue is fixed in version 2.50.0. Impact details in the connected sources indicate the lockout gap relates to TOTP/OTP checks,...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

CVE-2024-32868 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such mechanism fo...

ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

GHSA-7J7J-66CV-M239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...

PT-2024-24923 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 2.50.0 Description: ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a...

Checkmk 安全漏洞

Checkmk is an editor. A security vulnerability exists in Checkmk versions 2.3.0, 2.2.0, 2.1.0, and 2.0.0, which stems from the fact that login attempts via the REST API and basic authentication do not count against the lockout mechanism, and which can be exploited by an attacker to attempt to bru...

BIT-TOMCAT-2021-30640 Auth weakness in JNDIRealm

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0 to 10.0.5; 9.0.0 to 9.0.45; 8.5.0 to 8.5.65...

BIT-MOODLE-2022-30600

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed...

Duplicate Advisory: Keycloak DoS via account lockout

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block...

GHSA-3HRR-XWVG-HXVR Duplicate Advisory: Keycloak DoS via account lockout

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block...