38 matches found
CVE-2023-47111
CVE-2023-47111 describes a race condition in ZITADEL’s lockout policy: an attacker could initiate multiple parallel password checks, enabling more attempts than the policy allows. The issue affects ZITADEL’s identity infrastructure and relates to the handling of failed password checks within the ...
ZITADEL Competitive conditions loophole
ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL Switzerland. ZITADEL versions prior to 2.40.5, 2.38.3 and prior to 2.38.3 suffer from a Competing Conditions Issue vulnerability that...
VulnCheck KEV: CVE-2021-38153
Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...
DEBIAN-CVE-2023-28862
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an...
PT-2023-22013 · Unknown · Lemonldap::Ng
Name of the Vulnerable Software and Affected Versions: LemonLDAP::NG versions prior to 2.16.1 Description: An issue was discovered in LemonLDAP::NG that allows attackers to bypass 2FA verification due to weak session ID generation in the AuthBasic handler and incorrect failure handling during a...
PT-2023-16418 · Unknown · Phpgurukul Employee Leaves Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Employee Leaves Management System version 1.0 Description: A vulnerability was found in the PHPGurukul Employee Leaves Management System, affecting an unknown functionality of the file changepassword.php. The manipulation of the...
PT-2023-12070 · WordPress · Passster
Name of the Vulnerable Software and Affected Versions: Passster WordPress plugin versions prior to 3.5.5.9 Description: The issue allows unauthenticated users to bypass the protection offered by the plugin and access arbitrary posts, such as private content, by sending a specifically crafted...
Timing Attack
mailman3 is vulnerable to timing attacks. The vulnerability exists due to lack of constant time password checks which allows an attacker to perform timing attacks...
Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients
Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...
Vxscan
This is a Python script named Vxscan, which is a comprehensive scanning tool for sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning, SQL injection, and other functions. The...
D-Link DAP-2610 Authentication Bypass Vulnerability
The D-Link DAP-2610 is a wireless AC1300 Wave 2 dual-band PoE access point. An authentication bypass vulnerability exists in the handling of passwords in the D-Link DAP-2610 2.01RC067. The vulnerability stems from a lack of proper password checking. An attacker can exploit the vulnerability to...
curl: Case insensitive password comparison
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...
Fedora 27 : php-symfony3 (2018-c8ddc44bbb)
3.3.17 2018-05-25 - security cve-2018-11407 Ldap cast to string when checking empty passwords - security cve-2018-11408 SecurityBundle Fail if security.httputils cannot be configured - security cve-2018-11406 clear CSRF tokens when the user is logged out - security cve-2018-11385 migrating sessio...
USN-776-2: KVM regression
USN-776-1 fixed vulnerabilities in KVM. Due to an incorrect fix, a regression was introduced in Ubuntu 8.04 LTS that caused KVM to fail to boot virtual machines started via libvirt. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Avi Kivity discovered...
Ubuntu 8.04 LTS / 8.10 : kvm vulnerabilities (USN-776-1)
Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. CVE-2008-1945, CVE-2008-2004 Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly...
USN-517-1: kdm vulnerability
It was discovered that KDM would allow logins without password checks under certain circumstances. If autologin was configured, and "shutdown with password" enabled, a local user could exploit the problem and gain root privileges...
[USN-517-1] kdm vulnerability
=========================================================== Ubuntu Security Notice USN-517-1 September 24, 2007 kdebase vulnerability CVE-2007-4569 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubunt...