Authentication flaw

An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an unauthenticated attacker to obtain an administrative session via a protection mechanism failure in the authentication function...

How to recognize NetScaler Gateway user login failure related logs

This article describe how toRecognize NetScaler Gateway User Login failure related logs...

Moxa EDS-G516E and EDS-510E Series Ethernet Switches Weak Password Requirements (CVE-2020-6991)

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2023-35698

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt...

Citrix FAS - Incorrect username and password

Incorrect username and password FAS After launching desktop when users tries to log on. No error on the certificates, no error in "Application" and "System" in the FAS server. VDA event logs Windows logs Security and looking for audit failure at the same time as the login failure: 0xC000006A| use...

WEM Server Failed to Connect Database after SQL AlwaysOn Failover to Secondary

User has followed Citrix Doc below to setup AlwaysOn for WEM: https://docs.citrix.com/en-us/workspace-environment-management/current-release/system-requirements.htmlsql-server-always-on However, the WEM server won't be able to connect AlwaysOn database after a failover from primary SQL to...

SUSE CVE-2012-1101

systemd 37-1 does not properly handle non-existent services, which causes a denial of service failure of login procedure...

Secomea GateManager 授权问题漏洞

Secomea GateManager is a remote access server product from Secomea, Denmark. A security vulnerability exists in Secomea GateManager versions 9.4 through 9.7. An attacker has exploited the vulnerability to impersonate a previous user in certain login failures...

PVS Streamprocess: Login failed (error code: 4) for device <devicename>

Target devices are stuck at booting: Application event log is flooded with StreamProcess Event ID 10 that reads: "Login failed error code: 4 for device targetdevice1: No servers available for disk" Application event log will also have Streamprocess event ID 11's which read: "Detected one or more...

Design/Logic Flaw

NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally is converted to a URL object. The URL instantiation would fail due ...

CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally is converted to a URL object. The URL instantiation would fail due ...

ZEIT Next.js 代码问题漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. NextAuth.js is the authentication for Next.js. A code issue vulnerability exists in Next.js NextAuth.js versions prior to 3.29.5 and prior to 4.5.0 that stems from a lack of validati...

[Citrix Gateway] "Cannot complete your request" error after adding EPA configuration

In Citrix Gateway deployment, You may encounter "Cannot complete your request" error if adding a new EPA policy in AAA vServer. For example, you have the following existing configuration to implement post EPA scan based on group name: add authentication Policy NoAuthGroup01 -rule...

IBM Spectrum Protect Operations Center暴力破解漏洞

IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control of the IBM Spectrum Protect environment. IBM Spectrum Protect Operations Center is vulnerable to a brute-force cracking vulnerability that stems from cumulative login Failure count is invalid, and an...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

App Layering - (400) Bad Request with ImportOsLayer.ps1

ImportOsLayer.ps1 script PS C:\windows\Setup\Scripts .\ImportOsLayer.ps1 -ElmAddress -IgnoreCertError ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Script 0.0 DynamicModule1cbe0359-cdf4-45... New-CALOperatingSystem, New-CALSession Failed to call API at and Meth...

Cisco Small Business 缓冲区错误漏洞

Cisco Small Business is a switch from Cisco. A security vulnerability exists in the Cisco Small Business RV Series routers, which is caused by an exception in error handling during a failed login attempt. An attacker can exploit this vulnerability by submitting specially crafted HTTP packets to t...

Citrix ADC upgrade operations might cause login failure for local system user accounts

Any of the following Citrix ADC upgrade operations might cause login failure for local system user accounts: from Citrix ADC 13.0-83.x buildor later buildsto Citrix ADC 13.1-4.x build from Citrix ADC 12.1-63.x buildor later buildsto Citrix ADC 13.1-4.x build from Citrix ADC 12.1-63.x buildor late...

CVE-2021-35223

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution...

Remote code execution

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution...