Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update

Description The plugin is missing authorization on the toggleautoupdate AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin. As an Admin, open the Limit Login Attempts page in WP Admin and run the following code in the browser console: nonce =...

Twake Security Vulnerability

Twake is a secure open source collaboration platform open-sourced by LINAGORA that improves organizational productivity. A security vulnerability exists in versions prior to Twake 2023.Q1.1223 that stems from an improper restriction of too many authentication attempts...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

CVE-2023-5754 Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000

Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

Customer data stolen from gaming cloud host Shadow

Cloud infrastructure provider Shadow has warned of the data theft of over 500,000 customers. The customers were informed by a breach notification which was posted online. Cloud is known in the gaming world and, among other things, allows gamers to play resource heavy games on lower-end devices, T...

Microsoft Defender for Endpoint now stops human-operated attacks on its own

Defenders need every edge they can get in the fight against ransomware. Today, were pleased to announce that Microsoft Defender for Endpoint customers will now be able automatically to disrupt human-operated attacks like ransomware early in the kill chain without needing to deploy any other...

CVE-2023-43699

Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited...

Input validation

Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited...

CVE-2023-43699

Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited...

CVE-2023-43699

CVE-2023-43699 affects the SICK APU RDT400 (SICK Application Processing Unit). The vulnerability is an improper restriction of excessive authentication attempts, allowing an unprivileged remote attacker to guess passwords via trial-and-error because login attempts are not limited. Documents confi...

The vulnerability of the CODESYS Development System, a programming platform for embedded systems, lies in its insufficient authentication attempts limitation. This allows attackers to make an unlimited number of password input attempts.

The vulnerability of the CODESYS Development System, a programming platform for embedded systems, is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows attackers to perform an unlimited number of password input attempts...

Authentication flaw

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

CVE-2023-43669

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service minutes of CPU consumption via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted e.g., thousands of times and the average amount...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to an improper limitation on excessive authentication attempts. This allows a hacker to access the secret data of configured OAuth2 clients.

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to an improper limitation on excessive authentication attempts. Exploiting this vulnerability could allow a malicious actor to access the secret data of configured OAuth2 clients remotely...

PT-2023-27709 · Aurea · Arconte Áurea

Name of the Vulnerable Software and Affected Versions: ARCONTE Aurea version 1.5.0.0 Description: The authentication system could allow an attacker to make incorrect access requests, blocking each legitimate account and causing a denial of service. A resource has been identified that could allow...

ROS-20230913-02

Nextcloud server vulnerability is related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to access files within a subfolder of an accessible group folder, even if extended permissions block access to the subfolder. of a group folder, even if...

CVE-2023-40834

OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter...

X wants your biometric data

Users of X formerly Twitter paying for a checkmark under what used to be called Twitter Blue now X Premium have some biometric related decisions to make. The BBC reports that Elon Musk, having dismantled the old checkmark system to replace it with the all new Premium, is reintroducing identity...

DoLogin Security < 3.7 - IP Spoofing

Description The plugin uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing. PoC 1. Send login request with x-forwarded-for: REDACTEDIP 2. See spoofed IP address in the "Login Attempts Log"...