Obsidian Scheduler 安全漏洞

Obsidian Scheduler is an enterprise-level task scheduler from Obsidian USA. A security vulnerability exists in Obsidian Scheduler versions 5.0.0 through 6.3.0, which stems from an account lockout that still allows authentication via Basic Authentication, which could lead to bypassing MFA...

CVE-2025-56449

A security vulnerability exists in Obsidian Scheduler versions 5.0.0 through 6.3.0 within its REST API . The flaw allows accounts locked out for failing to enroll in Multi-Factor Authentication (MFA) to still authenticate using Basic Authentication to perform administrative actions. Specifically,...

CVE-2025-55795: Improper Access Control

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker with the Manage Users permission can prevent legitimate users, including administrators, from accessing the platform by modifying usernames to cause account lockouts or username takeovers. Workaround...

GHSA-Q82V-H4RQ-5C86 Rancher update on users can deny the service to the admin

Impact A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Specifically: - Username takeover: A user wit...

PT-2025-39663

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.12.2 Rancher versions prior to 2.11.6 Rancher versions prior to 2.10.10 Rancher versions prior to 2.9.12 Description A missing server-side validation on the .username field in Rancher allows users with update...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inodes xarray contention condition that could lead to a subvolume deletion lockout...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

CVE-2025-36064 affects IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0–3.1.0.22. The root cause is an inadequate account lockout setting that could permit a remote attacker to brute‑force credentials. IBM’s bulletin (and related sources) list a CVSS v3.1 base score of 5.9 (NEU...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064: Improper Restriction of Excessive Authentication Attempts

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

PT-2025-38985

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22 Description The software uses an inadequate account lockout setting. This could allow a remote attacker to attempt to brute force account credentials...

IBM Sterling Connect:Express for Microsoft Windows 安全漏洞

IBM Sterling Connect:Express for Microsoft Windows is a secure file transfer gateway software from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22, which stems from an insufficient account...

ROS-20250905-07

A vulnerability in the user locking mechanism of the Vault Enterprise and Vault Community Edition enterprise data archiving platforms is due to the application not performing the correct normalization of the application. Enterprise and Vault Community Edition is related to the fact that the...

Brute-force Attack

soosyze/soosyze is vulnerable to Brute-force Attack. The vulnerability is due to missing rate-limiting and account lockout mechanisms on the /user/login endpoint, which allows an attacker to repeatedly attempt logins and potentially gain unauthorized administrative access...

Linux Distros Unpatched Vulnerability : CVE-2022-30600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. CVE-2022-30600 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2021-38155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account...