LoLLMs 安全漏洞

LoLLMs is a large language and multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from a risk of a timing difference attack in the authenticateuser function in lollmsauthentication.py, which could lead to username enumeration and...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate versions prior to 5.12, which stems from a failure to rate-limit second-factor authentication and could lead to OTP guessing...

MAYA: Addressing Inconsistencies in Generative Password Guessing through a Unified Benchmark

Recent advances in generative models have led to their application in password guessing, with the aim of replicating the complexity, structure, and patterns of human-created passwords. Despite their potential, inconsistencies and inadequate evaluation methodologies in prior research have hindered...

CVE-2024-1729

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation app.authusername == password to validate user credentials, which can be exploited to guess password...

CVE-2022-2822

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

CVE-2021-26113

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

CVE-2020-10102

An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized a...

CVE-2020-7525

Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX formerly homeLYnk which could allow an attacker to guess a password when brute force is used...

CVE-2025-48014

Password guessing limits could be bypassed when using LDAP authentication...

CVE-2019-13918

A vulnerability has been identified in SINEMA Remote Connect Server All versions V2.0 SP1. The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user...

CVE-2012-3798

The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks...

CVE-2002-2119

Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing...

CVE-2002-2028

The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been locked when a valid password is provided, which makes it easier for users with physical access to conduct brute force password guessing...

CVE-2025-48014

Password guessing limits could be bypassed when using LDAP authentication...

CVE-2025-48014 Improper Restriction of Excessive Authentication Attempts

Password guessing limits could be bypassed when using LDAP authentication...

CVE-2025-48014

CVE-2025-48014 affects Schweitzer Engineering Laboratories (SEL) Series software/firmware where password guessing limits can be bypassed when LDAP authentication is used. The linked records describe a bypass of login-account protection without detailing the exact vulnerable component version(s) o...

CVE-2025-48014 Improper Restriction of Excessive Authentication Attempts

Password guessing limits could be bypassed when using LDAP authentication...

PT-2025-22150 · Schweitzer Engineering Laboratories · Sel-5056 Software-Defined Network Flow Controller

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows password guessing limits to be bypassed when using LDAP authentication. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

Schweitzer Engineering Laboratories SEL Series 安全漏洞

Schweitzer Engineering Laboratories SEL Series is a series of software and firmware products from Schweitzer Engineering Laboratories, Inc. A security vulnerability exists in the Schweitzer Engineering Laboratories SEL Series that stems from the possibility of bypassing password guessing...

CVE-2025-48014: Improper Restriction of Excessive Authentication Attempts

Password guessing limits could be bypassed when using LDAP authentication...