2513 matches found
CVE-2024-4629 Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...
CVE-2024-4629
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...
`Endpoint::retry()` calls can lead to panicking
In 0.11.0, we overhauled the server-side Endpoint implementation to enable more careful handling of incoming connection attempts. However, some of the code paths that cleaned up state after connection attempts were processed confused the initial destination connection ID with the destination...
CVE-2024-2502
An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event a tamper reset occurs. This impacts Series 2 HSE-SVH...
CVE-2024-2502 Failure to update the tamper reset cause register when a tamper event occurs
An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event a tamper reset occurs. This impacts Series 2 HSE-SVH...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 19, 2024 to August 25, 2024)
Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 14th, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and ...
WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 - IP Address Spoofing to Protection Mechanism Bypass vulnerability
IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin LOGIN AND REGISTRATION ATTEMPTS LIMIT versions = 2.1...
CVE-2022-4532
The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...
PT-2024-11697 · WordPress · Login/Registration Attempts Limit
Name of the Vulnerable Software and Affected Versions: LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress versions up to, and including, 2.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login...
CVE-2024-43042
Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...
CVE-2024-42466
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...
CVE-2024-42465
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...
CVE-2024-42465 Lack of resources and rate limiting - two factor authentication
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...
upKeeper 安全漏洞
upKeeper is a cloud-based or local solution from upKeeper, Inc. A security vulnerability exists in upKeeper version 5.1.9 and prior versions that stems from the presence of a vulnerability that improperly restricts excessive authentication attempts, allowing for misuse of authentication...
Pluck 安全漏洞
Pluck is a small and simple content management system written in PHP by Pluck CMS Open Source. A security vulnerability exists in Pluck version 4.7.18 that stems from not limiting failed login attempts, allowing an attacker to perform a brute force attack...
upKeeper 安全漏洞
upKeeper is a cloud-based or local solution from upKeeper, Inc. A security vulnerability exists in upKeeper version 5.1.9 and prior versions that stems from the presence of a vulnerability that improperly restricts excessive authentication attempts, allowing for misuse of authentication...
PT-2024-30268 · Pluck Cms · Pluck Cms
Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.18 Description: The issue allows attackers to execute a brute force attack due to the lack of restriction on failed login attempts. Recommendations: For Pluck CMS version 4.7.18, consider implementing a custom restrictio...
PT-2024-29961 · Unknown · Upkeeper Manager
Name of the Vulnerable Software and Affected Versions: upKeeper Manager versions through 5.1.9 Description: The issue is related to an improper restriction of excessive authentication attempts in upKeeper Manager, allowing authentication abuse. This problem can be exploited, potentially leading t...
CVE-2024-43042
CVE-2024-43042 affects Pluck CMS 4.7.18: the login subsystem does not limit failed attempts, enabling brute-force-style access attempts over the network. Public sources in the connected documents corroborate the issue's existence and classify it as high severity (CVSSv3.1: 9.8, Confidentiality, I...