Authentication flaw

ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the...

CVE-2023-4094

ARCONTE Aurea Arconte Áurea 1.5.0.0 has a weak authentication vulnerability that lets an attacker issue false login attempts to block legitimate accounts and cause a denial of service. A separate resource indicates a method to circumvent the login attempt limit. Public documents identify the affe...

CVE-2023-37484

SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory...

CVE-2023-37484 Information Disclosure Vulnerabilities in SAP PowerDesigner

SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory...

CVE-2023-29301

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the...

PT-2023-24522 · Piigab · M-Bus Softwarepack +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns the lack of limitation on the number of login attempts, which could allow an attacker to perform a brute force attack on HTTP basic...

The vulnerability of the FortiSIEM security management system lies in its insufficient authentication attempt limitation, which allows attackers to circumvent existing security restrictions.

The vulnerability of the FortiSIEM security management system is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...

Limit Login Attempts < 1.7.2 - Unauthenticated Stored XSS

The plugin does not sanitize and escape the IP address retrieved from headers such as X-Forwarded-For when the "Site Connection" settings is set to "From behind a reversy proxy", which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks Setup: As admin, set the...

Denial Of Service (DoS)

moodle/moodle is vulnerable to denial of service. The vulnerability exists in loginattemptfailed function in authlib.php due to incorrect calculation of login attempts which allows an attacker to cause an application crash...

CVE-2022-24040

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application fails to enforce an upper bound to the cost factor of the PBKD...

IBM MQ Appliance 安全漏洞

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. An information disclosure vulnerability exists in IBM MQ Appliance, which stems from an apparent discrepancy between valid and invalid login attempts, and can be exploited by...

CVE-2021-43436

MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

CVE-2021-37934

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing...

CVE-2021-37934

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing...

Default credentials

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing...

ASUS routers 安全漏洞

ASUS routers is a router app from ASUS of Taiwan, China. A security vulnerability exists in ASUS routers that stems from a problem with the router firmware's limit on the number of login attempts, which allows remote attackers to attempt an arbitrary number of login attempts by sending a specific...

ManageEngine ADAudit Plus Authenticated File Write RCE

This module exploits security issues in ManageEngine ADAudit Plus prior to 7006 that allow authenticated users to execute arbitrary code by creating a custom alert profile and leveraging its custom alert script component. The module first runs a few checks to test the provided credentials, retrie...

The vulnerability of the SCADA system of OIK Dispetchner NT is related to deficiencies in the mechanism for limiting the number of authentication attempts. This allows a violator to circumvent existing security restrictions by using brute-force attacks.

The vulnerability of the SCADA system of OIK Dispatching is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions by using brute-force attacks...

CVE-2020-8189

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations lies in the improper limitation on the number of unsuccessful authentication attempts. This allows a perpetrator to gain full access.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to an improper limitation on the number of unsuccessful authentication attempts. Exploiting this vulnerability can allow a malicious actor...