CVE-2024-45790 User Enumeration vulnerability

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

CVE-2024-45327

FortiSOAR is affected by an improper authorization vulnerability (CWE-285) in the change password endpoint, enabling an authenticated attacker to perform brute force attacks on user and administrator passwords. Affected FortiSOAR versions are 7.0.0–7.0.3, 7.2.0–7.2.2, 7.3.0–7.3.2, and 7.4.0–7.4.3...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores lies in insufficient restrictions on authentication attempts. This allows attackers to bypass security measures and carry out brute-force attacks.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and carry out a...

CVE-2021-22530

A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authenticati...

CVE-2021-22530

CVE-2021-22530 affects NetIQ Advance Authentication and describes a brute-force risk on the API login that does not enforce account lockout. Affected are versions prior to 6.3.5.1. Potential impact includes user account compromise and possible server performance degradation. Remediation per the c...

CVE-2021-22530 Improper account management vulnerability in NetIQ Advance Authentication

A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authenticati...

Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 Thi...

CVE-2024-43042

Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...

CVE-2024-43042

Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...

CVE-2024-43042

CVE-2024-43042 affects Pluck CMS 4.7.18: the login subsystem does not limit failed attempts, enabling brute-force-style access attempts over the network. Public sources in the connected documents corroborate the issue's existence and classify it as high severity (CVSSv3.1: 9.8, Confidentiality, I...

Siemens Location Intelligence Weak Password Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. Siemens Location Intelligence suffers from a weak password vulnerability that can be exploited by attackers to conduct...

Siemens Location Intelligence Logic Flaw Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. A logic flaw vulnerability exists in Siemens Location Intelligence that stems from not enforcing a limit on too many...

Siemens SINEC Traffic Analyzer Logic Flaw Vulnerability (CNVD-2024-35433)

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communications between controllers and IO devices. A logic flaw vulnerability exists in Siemens SINEC Traffic Analyzer, which stems from the application not properly limiting the number of authentication attempts,...

Defending Against a Login API Brute Force Attack

...

CVE-2024-41904

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V2.0. The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate use...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...