The vulnerability of the FortiSIEM security management system lies in its insufficient authentication attempt limitation, which allows attackers to circumvent existing security restrictions.

The vulnerability of the FortiSIEM security management system is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...

CVE-2023-34240

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

Design/Logic Flaw

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

CVE-2023-34240 Weak passwords allowed in cloudexplorer-lite

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

CVE-2023-34240

CVE-2023-34240 affects CloudExplorer-Lite prior to v1.2.0, where the authentication system did not enforce strong passwords, enabling weak-password guessing/brute-force attempts and potential authentication failures. Multiple sources confirm the issue and fix in v1.2.0, with upgrade advised. The ...

CVE-2023-34240 Weak passwords allowed in cloudexplorer-lite

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

CVE-2022-43949

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

Design/Logic Flaw

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

CVE-2022-43949

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

CVE-2023-34227

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks...

CVE-2023-34227

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks...

Joomla 4.2.x < 4.3.2 Multiple Vulnerabilities (5887-joomla-4-3-2-security-and-bug-fix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.2.x prior to 4.3.2. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issu...

CVE-2023-31135

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

Design/Logic Flaw

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

GHSA-92WQ-Q9PQ-GW47 Dgraph Audit Log Encryption Vulnerability

Impact Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph v23.0.0 are affected. Patches This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0. Workaround...

CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

CVE-2023-31135

CVE-2023-31135 affects Dgraph audit logs due to nonce collisions in the log encryption scheme. The first 12 bytes come from a baseIv, and the last 4 bytes from the log line length; because log lines often share the same length, nonces are reused. All audit logs generated by versions

CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

PT-2023-23169 · Dgraph · Dgraph

Name of the Vulnerable Software and Affected Versions: Dgraph versions prior to v23.0.0 Description: Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is...

CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware

Poorly managed Microsoft SQL MS SQL servers are the target of a new campaign that's designed to propagate a category of malware called CLR SqlShell that ultimately facilitates the deployment of cryptocurrency miners and ransomware. "Similar to web shell, which can be installed on web servers,...