CVE-2023-28847

CVE-2023-28847 affects Nextcloud Server and Enterprise Server. Description: an attacker could brute-force the password of a share link due to missing brute-force protection. Affected versions include Nextcloud Server 24.0.0–24.0.10, 25.0.0–25.0.4, and Enterprise 23.0.0–23.0.11, plus related 24.0....

CVE-2023-28847 Nextcloud Server missing brute force protection for passwords of password protected share links

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attack...

AZL-13740 CVE-2023-0567 affecting package php for versions less than 8.1.16-1

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

password_verify() always returns true for some invalid hashes

...

SUSE CVE-2010-2944

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

SUSE CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different...

SQL injection in API authorization check

Description TeamPass /authorize API endpoint is vulnerable to SQL injection in the login field. It is possible to forge an arbitrary Blowfish hash and use it in the query to bypass the password verification check. Using the same query it is possible to define an arbitrary apikey value too: "login...

Design/Logic Flaw

There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed...

CVE-2022-33735

There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed...

CVE-2022-33735

There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed...

CVE-2022-33735

Summary (CVE-2022-33735) Huawei WS7200-10 devices (11.0.2.13) on LAN are affected by a password verification vulnerability due to an incorrect authentication algorithm implementation. Attackers on the LAN can perform brute-force attempts to obtain passwords, potentially leading to disclosure of s...

CVE-2022-2302

Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password...

CVE-2022-2302

CVE-2022-2302 affects Lenze cabinet series (c520, c550, c750) with firmware versions V01.07.00.2757 through V01.08.01.3021. The root cause is skipping password verification during second login, allowing a remote attacker who has an authenticated session to gain full access without knowing the pas...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

CVE-2022-29270

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

CVE-2022-29270

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

CVE-2022-29270

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

CVE-2022-29270

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

CVE-2022-29270

CVE-2022-29270 affects Nagios XI (<= 5.8.5). The vulnerability allows a user without password verification to change their own e‑mail address, indicating an authentication bypass at the account-management layer. The NVD data lists CVSS v3.1 base score 4.3 (LOW) with NETWORK attack vector and n...

PT-2022-19512 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.8.5 and earlier Description: The issue allows a user to change their e-mail address without password verification. Recommendations: For Nagios XI versions 5.8.5 and earlier, at the moment, there is no information about a...