1200 matches found
GoScanSSH Malware Targets SSH Servers, But Avoids Military and .GOV Systems
Researchers have identified a new malware family, dubbed GoScanSSH, that targets public facing SSH servers, but avoids those linked to government and military IP addresses. The malware has been in the wild since June 2017 and exhibits a number of unique characteristics, such as being written in t...
EMC RSA Archer GRC Platform User Enumeration Vulnerability
EMC RSA Archer GRC Platform is an enterprise IT governance and compliance governance product from EMC Corporation USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A user enumeration vulnerability exists in the API fil...
WPA3 will secure Wi-Fi connections in four significant ways in 2018
CES, the annual consumer electronics extravaganza in Las Vegas, isn’t just a showcase for virtual reality and poorly-timed power outages. It’s also an opportunity to get a peek at the future of network security. That’s why on the first day of CES, the Wi-Fi Alliance announced the newest security...
Hackers Targeting Servers Running Database Services for Mining Cryptocurrency
Security researchers have discovered multiple attack campaigns conducted by an established Chinese criminal group that operates worldwide, targeting database servers for mining cryptocurrencies, exfiltrating sensitive data and building a DDoS botnet. The researchers from security firm GuardiCore...
Design/Logic Flaw
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attack...
DEBIAN-CVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attack...
CVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attack...
CVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attack...
Insecure Token Passwords
Hadoop-common is vulnerable to brute-force attacks due to insecure token passwords. When Kerberos security features are enabled, token passwords are generated using only a 20-bit secret. Leveraging this flaw, attacker can easily crack secret keys using a brute-force attack...
netFORUM Authentication - Moderately critical - Access Bypass - SA-CONTRIB-2017-077
The netFORUM Authentication module implements external authentication for users against netFORUM. The module does not correctly use flood control making it susceptible to brute force attacks...
Fuze Patches TPN Handset Vulnerabilties
Fuze, a maker of popular enterprise-grade voice-over-IP handsets, earlier this year patched three vulnerabilities that exposed user account information and enabled unauthorized authentication. The issues were made public today by researchers at Rapid7 who privately disclosed the flaws on April 12...
CVE-2017-7551
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts...
CVE-2017-11187
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly...
Design/Logic Flaw
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly...
CVE-2017-11187
The CVE concerns phpMyFAQ prior to version 2.9.8, where login brute-force protection is insufficient—allowing rapid, repeated invalid authentication attempts. The issue is tied to failure to mitigate brute-force attacks. Remediation evidenced across sources suggests upgrading to version 2.9.8 or ...
Design/Logic Flaw
A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...
CVE-2017-6032
A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...
CVE-2017-6032
A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...
Stellar.org: HTTP - Basic Authentication on https://www.stellar.org/wp-login.php
Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication. PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin Impact: Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks. Fix: HTTP-Basic...
