Hardcoded credentials

The web app client of TP-Link AX10v1 V1211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attac...

Security Bulletin: The IBM® Engineering Lifecycle Management products recommendation for IBM WebSphere Application Server Liberty vulnerability to Identity Spoofing (CVE-2022-22475)

Summary On applications on IBM WebSphere Application Server Liberty, an authenticated user could use a brute force attack to extract an encryption key from LTPA token and through a series of involved steps could conduct an attack whereby they replace their user name with that of another user in t...

CVE-2022-41540

CVE-2022-41540 affects the TP-Link AX10v1 web app client for V1_211117, where the client uses hard-coded cryptographic keys when talking to the router. This enables a man-in-the-middle attacker to brute-force the sequence key and potentially access sensitive information. Public details indicate a...

PT-2022-6112 · Tp Link · Tp-Link Ax10V1

Name of the Vulnerable Software and Affected Versions: TP-Link AX10v1 version V1 211117 Description: The web app client of TP-Link AX10v1 uses hard-coded cryptographic keys when communicating with the router. This allows attackers to obtain the sequence key via a brute-force attack if they can...

TP-LINK AX10 信任管理问题漏洞

The TP-LINK AX10 is a router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK AX10 version V12111117, which originates from the use of hard-coded encryption keys by web application clients when communicating with the router. An attacker could use this vulnerability to obtain...

CVE-2022-40055

An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page...

Design/Logic Flaw

An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page...

CVE-2022-40055

CVE-2022-40055 affects GX Group GPON ONT Titanium 2122A T2122-V1.26EXL. The issue allows attackers to escalate privileges via brute-force attempts at the login page. Base CVSS v3.1: 9.8 (CRITICAL), from NETWORK attack vector, NONE privileges required, low attack complexity, no user interaction. I...

PT-2022-20060 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.1.6 GitLab CE/EE versions 15.2 through 15.2.3 GitLab CE/EE versions 15.3 through 15.3.1 Description: An issue has been discovered in GitLab CE/EE that may allow an attacker to guess a user's password by brute...

CVE-2022-40055

An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page...

CVE-2022-40055

An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page...

CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...

CVE-2022-35846

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

PT-2022-5115 · Dell Emc · Dell Emc Xtremio

Name of the Vulnerable Software and Affected Versions: Dell EMC XtremIO versions prior to X2 6.4.0-22 Description: The issue is related to insufficient authentication attempt limitation, allowing a remote unauthenticated attacker to potentially exploit it and gain access to an admin account throu...

PT-2022-5028 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow an...

CVE-2022-35846

The CVE-2022-35846 entry covers FortiTester with a flaw in the Telnet port that allows brute-force credential guessing for the admin user due to an improper restriction of excessive authentication attempts. Affected FortiTester versions are 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0. The core issu...

CVE-2022-40895

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password...

Design/Logic Flaw

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password...

CVE-2022-40895

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password...

CVE-2022-40895

CVE-2022-40895 affects NeDi’s web UI login and Community login, where an insecure design in the forgot-password flow enables unauthenticated, remote user enumeration and brute-force attempts against valid usernames. Reported impact is integrity compromise for affected devices; attack vector is ne...