Security Bulletin: IBM App Connect Enterprise is vulnerable to an information disclosure and a denial of service. (CVE-2024-22317)

Summary The remote administration API in IBM App Connect Enterprise is vulnerable to an information disclosure and denial of service vulnerability due to improper Brute Force protection. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

The vulnerability of Microprogrammed Software in EuroTel ETL3100 and EuroTel ETL3100RT transmission devices lies in the improper limitation on the number of unsuccessful authentication attempts, allowing a perpetrator to gain full access.

The vulnerability of Microprogrammed Software in EuroTel ETL3100 and EuroTel ETL3100RT teleconverters is related to the absence of restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to gain full access through brute-force attacks...

WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to bruteforce users credentials. An attacker can send a seri...

SUSE CVE-2023-49792

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...

Nextcloud Security Breach

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. A security vulnerability exists in Nextcloud Server that stems from the fact that when a proxy is configured as a trusted proxy, the server may be tricked...

PT-2023-9241 · Unknown · Masterscada 4D

Name of the Vulnerable Software and Affected Versions: MasterSCADA 4D affected versions not specified Description: The issue is related to insufficient restriction of authentication attempts in the MasterSCADA 4D system. This can be exploited by a remote attacker to perform a brute force attack...

M-Files Server Security Vulnerability

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server versions prior to 23.12.13205.0, which stems from a vulnerability that allows an attacker to make unlimited authentication attempts...

CVE-2023-6928 Improper Restriction of Excessive Authentication Attempts

EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system...

Bruteforce protection can be bypassed with misconfigured proxy

None...

CVE-2023-6756

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack...

Design/Logic Flaw

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack...

Exposure of Sensitive Information

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information via a brute force attack. An attacker can collect valid usernames by repeatedly attempting to authenticate with different usernames. Remediation Upgrade Umbraco.Cms to version 10.8.1, 12.3.4 or higher...

CVE-2023-35039

Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15...

CVE-2023-35039 WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication

Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15...

The vulnerability in the FortiOS operating system’s web interface allows attackers to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the FortiOS operating system’s web interface is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...

Fortinet FortiMail Authentication Error Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides e-mail security and data protection features. An authentication error vulnerability exists in Fortinet FortiMail that stems from improperly limiting excessive authentication attempts. A...

CVE-2023-45582

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts...

CVE-2023-41270

Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to cause a denial of service via WPS attack tools...

CVE-2023-41270 Samsung Smart TV UE40D7000 WPS DoS attack

Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to cause a denial of service via WPS attack tools...

SAMSUNG Smart Things Security Breach

SAMSUNG Smart TV is a series of smart TV products from South Korea's Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Smart TV, which stems from an improperly restricted vulnerability to excessive authentication attempts, allowing an attacker to cause a denial of service via the WPS...