How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

Co-authored by Ryan Barnett. AppSec Protections for Microsoft Exchange CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 On March 2, 2021, the Microsoft Security Response Center alerted its customers to several critical security updates to Microsoft Exchange Server, addressing...

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

On March 2, 2021, the Microsoft Security Response Center alerted its customers to several?critical security?updates to Microsoft Exchange Server, addressing vulnerabilities currently?under attack...

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

On March 2, 2021, the Microsoft Security Response Center alerted its customers to several critical security updates to Microsoft Exchange Server, addressing vulnerabilities currently under attack...

Updated openssh packages fix a security vulnerability

The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts where no host key for the server has been cached by the client CVE-2020-14145...

Protecting Your Data from Cyber Extortion: Lessons from the Latest Mega-hack

At the end of last year, enterprise firewall company Accellion was the victim of a two-phase SQL injection attack that resulted in significant sensitive data breaches over the last number of months. This attack is important for several reasons. It underscores the rise in frequency of incidents...

CVE-2021-21324

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference IDOR on "Solutions". This vulnerability gives an unauthorized user the abili...

CVE-2021-21324

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference IDOR on "Solutions". This vulnerability gives an unauthorized user the abili...

CVE-2021-22883

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unabl...

Denial Of Service (DoS)

nodejs is vulnerable to denial of serviceDoS attacks. A remote attacker could cause memory exhaustion via too many connection attempts with an 'unknownProtocol' leading to system unavailability...

CVE-2021-22883

A flaw was found in nodejs. When too many connection attempts with an 'unknownProtocol' are established a leak of file descriptors can occur leading to a potential denial of service. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and...

Advantech Spectre RT Industrial Routers

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: Spectre RT Industrial Routers Vulnerabilities: Improper Neutralization of Input During Web Page Generation, Cleartext Transmission of Sensitive Information, Improper...

The vulnerability of the microprogrammed network router Advantech BB-ERT351, related to authentication errors, allows a hacker to obtain the administrator’s password.

The vulnerability of the microprogrammed network router Advantech BB-ERT351 is related to the lack of restrictions on the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to brute-force the administrator password remotely...

CVE-2021-27188

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...

Code injection

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...

CVE-2021-27188

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...

CVE-2021-27188

The CVE-2021-27188 entry concerns the Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1. Impact is a denial of service: an attacker can trigger an access suspension of five hours by making five invalid login attempts. The root cause is not explicitly detailed in the available docume...

CVE-2021-20635

Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network...

CVE-2021-20635

CVE-2021-20635 affects LOGITEC LAN-WH450N/GR. The vulnerability is an improper restriction of excessive authentication attempts, enabling an attacker within wireless range to recover the PIN and gain network access. The issue is documented across multiple feeds (NVD/Red Hat/JVN) with reported imp...

JVN#96783542: Multiple vulnerabilities in multiple LOGITEC products

Multiple products provided by LOGITEC CORPORATION contain multiple vulnerabilities listed below. Improper restriction of excessive authentication attempts CWE-307 - CVE-2021-20635 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 4.3 CVSS v2|...

The vulnerability of the TrueConf software lies in its lack of mechanisms to limit the number of authentication attempts. This allows a violator to lock out a user’s account.

The vulnerability of the TrueConf software is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability could allow a malicious actor to lock out a user’s account by attempting more than 10 unsuccessful password entries...