38088 matches found
CVE-2025-65427
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...
Unvalidated Redirect
NocoDB is vulnerable to an unvalidated redirect. The vulnerability is due to missing validation of the user-controlled continueAfterSignIn parameter in the login flow, which allows an attacker to redirect authenticated users to arbitrary external websites after login...
[SECURITY] Fedora 43 Update: util-linux-2.41.3-7.fc43
The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, util-linux contains the fdisk configuration tool and the login program...
PT-2025-51872
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 are susceptible to an open redirect issue because of inadequate validation of the cancelUri parameter during user login. This allows an attacker to construct a link that...
AVideo 输入验证错误漏洞
AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. An input validation error vulnerability exists in AVideo versions prior to 20.0 that stems from a lack of validation of the cancelUri parameter during user login, which could lead to open redirection and...
Unity Linux 20.1060a / 20.1070a Security Update: util-linux (UTSA-2025-991271)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991271 advisory. A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function,...
CVE-2025-65185
Entrinsik Informer v5.10.1 is vulnerable to a username enumeration flaw during the local user login process. An attacker can enumerate valid users by submitting an OTP code and a new password , then analyzing the resulting application responses. No information regarding a patched version or speci...
CVE-2025-65185
There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses...
CVE-2025-65185
There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses...
PT-2025-51839
Name of the Vulnerable Software and Affected Versions Entrinsik Informer version 5.10.1 Description A malicious user can enumerate usernames through local user login. This is achieved by entering an OTP code and a new password, then analyzing the application's responses. Recommendations At the...
PT-2025-51874
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 have an issue where sensitive user information is exposed through an unauthenticated public API endpoint. The responses from this endpoint include emails, usernames,...
Entrinsik Informer 安全漏洞
Entrinsik Informer is a business intelligence and data analytics platform from US-based Entrinsik. A security vulnerability exists in Entrinsik Informer version 5.10.1, which stems from the presence of username enumeration at local user login, which could lead to a malicious user enumerating user...
org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
A flaw was found in org.apache.kafka. The JndiLoginModule within the SASL authentication mechanism allows remote code execution and denial of service when misconfigured. This flaw allows an attacker to provide a malicious JNDI URI within the Kafka broker's configuration, permitting arbitrary code...
CVE-2023-53878
Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-Length header parsing. Attackers can send crafted POST requests with smuggled secondary requests to potentially bypass server-side request...
CVE-2023-53873
SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service...
EUVD-2025-203805
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...
WordPress JAY Login & Register plugin <= 2.4.01 - Authentication Bypass via Cookie vulnerability
Authentication Bypass via Cookie vulnerability discovered by kr0d in WordPress Plugin JAY Login & Register versions = 2.4.01...
CVE-2025-65427
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...
CVE-2025-65427
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations...
WordPress Login Lockdown & Protection plugin <= 2.14 - IP Block Bypass vulnerability
IP Block Bypass vulnerability discovered by William Cooke - Modux in WordPress Plugin Login Lockdown versions = 2.14...