PT-2024-36399 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8121 Description: The issue concerns an authenticated SQL injection vulnerability in the account lockout report of Zohocorp ManageEngine ADAudit Plus. This vulnerability allows for malicious S...

CVE-2024-5467: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report...

CVE-2024-37028

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028

CVE-2024-37028 affects BIG-IP Next Central Manager. An unauthenticated attacker can lock out a webUI account that has never been logged in (control-plane issue only; no data plane exposure). Affected: BIG-IP Next Central Manager 20.1.0–20.2.0; Fix: 20.2.1 (see F5 advisory K000139938). CVSS detail...

CVE-2024-37028 BIG-IP Next Central Manager vulnerability

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028 BIG-IP Next Central Manager vulnerability

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028: Overly Restrictive Account Lockout Mechanism

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

PT-2024-27251 · F5 · Big-Ip Next Central Manager

Name of the Vulnerable Software and Affected Versions: BIG-IP Next Central Manager affected versions not specified Description: The issue allows an attacker to lock out an account that has never been logged in. Note that software versions which have reached End of Technical Support EoTS are not...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-41432

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

CVE-2024-41432

CVE-2024-41432 affects Likeshop up to 2.5.7.20210811. The issue is IP spoofing via forged X-Forwarded or Client-IP headers, enabling attackers to bypass admin login lockouts, spoof server requests, and impersonate other IPs tied to user sessions. No explicit fixes or patches are provided in the c...

CVE-2024-41432: Authentication Bypass by Spoofing

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...

PT-2024-29393

Name of the Vulnerable Software and Affected Versions Likeshop versions up to 2.5.7.20210811 Description The issue allows an attacker to replace their real IP address with any arbitrary IP address by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. This can be used to bypass accou...

PT-2024-28259 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts. This...

Security Bulletin: Denial of service and password enumeration might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2023-45288, CVE-2024-25031, CVE-2024-38322, CVE-2024-33883. Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION:...

CVE-2024-25031

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678...

CVE-2024-25031

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678...