CVE-2024-28825

CVE-2024-28825 affects Checkmk installations where login attempts are not adequately limited. The vulnerability exists in multiple Checkmk branches prior to fixes: 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and (EOL) 2.0.0. Root cause: insufficient restriction on excessive authentication attempts for ce...

Oracle Critical Patch Update Advisory - April 2024

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...

The vulnerability of the Chamberlain myQ gate control device’s software lies in its insufficient attempt-limiting mechanism. This allows a intruder to circumvent existing security measures through brute-force attacks.

The vulnerability of the Chamberlain myQ gate control device’s software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to circumvent existing security measures through brute-force attacks...

PT-2024-4760 · Энтек · Энтек

Name of the Vulnerable Software and Affected Versions: ЭНТЕК affected versions not specified Description: The issue is related to insufficient restriction of authentication attempts in the SCADA system. This can be exploited by a remote attacker to perform a brute force attack. Recommendations: A...

CVE-2024-30390 Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced

An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service DoS to the management plane. When an incoming connection was blocked because it exceeded the...

CVE-2024-30390 Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced

An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service DoS to the management plane. When an incoming connection was blocked because it exceeded the...

Juniper Junos OS Vulnerability (JSA79183)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA79183 advisory. - An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause ...

Real-time File Access Monitoring (FAM) with Qualys FIM

What is File Access Monitoring FAM? FAM is a security practice that involves tracking and logging access to sensitive files. FAM should be included with any File Integrity Monitoring FIM solution to trigger alerts when critical host files not intended for regular use are accessed. Importance of F...

argo-cd: Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

A bypass of brute force protection flaw was found in Argo CD. Since login attempts are stored only in memory, every time the server restarts, that number is lost and unlimited login attempts can be made. It is possible to bypass brute force protections by chaining this issue with a denial of...

argo-cd: Denial of Service Due to Unsafe Array Modification in Multi-threaded Environment

A flaw was found in Argo CD that may result in a remote denial of service. The expireOldFailedAttempts function modifies an array while it is being iterated over. This issue may cause an application crash when executed in a multi-threaded environment if two threads interact with the same array...

PT-2024-4788 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 21.4R3-S4-EVO Junos OS Evolved versions 22.1-EVO prior to 22.1R3-S3-EVO Junos OS Evolved versions 22.2-EVO prior to 22.2R3-S2-EVO Junos OS Evolved versions 22.3-EVO prior to 22.3R2-S1-EVO, 22.3R3-EVO...

CVE-2024-3202

A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4. This issue affects some unknown processing of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated...

Stupid Simple CMS 安全漏洞

Stupid Simple CMS is a content management system by codelyfe individual developers. A security vulnerability exists in Stupid Simple CMS version 1.2.4, which stems from the lack of a limit on the number of authentication attempts...

BIT-MOODLE-2024-25980 Msa-24-0003: h5p attempts report did not respect activity group settings

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers...

CVE-2024-30439

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BestWebSoft Limit Attempts by BestWebSoft allows Reflected XSS.This issue affects Limit Attempts by BestWebSoft: from n/a through 1.2.9...

CVE-2024-30439 WordPress Limit Attempts by BestWebSoft plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BestWebSoft Limit Attempts by BestWebSoft allows Reflected XSS.This issue affects Limit Attempts by BestWebSoft: from n/a through 1.2.9...

CVE-2024-30439

CVE-2024-30439 is a reflected XSS in BestWebSoft Limit Attempts plugin for WordPress, caused by improper neutralization of input during web page generation. Affected versions are from n/a up to 1.2.9. Public records (Red Hat entry) confirm the root cause and vulnerability class but do not specify...

WordPress Plugin Limit Attempts by BestWebSoft 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress Plugin Limit Attempts by BestWebSoft A...

PT-2024-23367 · Bestwebsoft · Limit Attempts

Name of the Vulnerable Software and Affected Versions: Limit Attempts by BestWebSoft versions 1.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

Denial Of Service (DOS)

github.com/argoproj/argo-cd is vulnerable to Denial Of Service. The vulnerability is due to the in-memory data storage which does not persist on restart, which allows attackers to perform unlimited login attempts and potentially disrupt services...