MFA bombing taken to the next level

Simply put, MFA bombing also known as “push bombing” or “MFA fatigue” is a brute force attack on your patience. Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication MFA. MFA normally requires a user to enter a six-digit code sent by SMS, or...

CVE-2023-49232

CVE-2023-49232 affects Stilog Visual Planning 8. An unauthenticated attacker can bypass authentication by brute-forcing administrative password reset PINs, enabling account access via the Visual Planning app. The vulnerability impacts the password-reset flow and can lead to administrative comprom...

The vulnerability of the caching mechanism of the declarative delivery tool for GitOps in Kubernetes Argo CD allows attackers to circumvent security restrictions and execute an brute-force attack.

The vulnerability of the caching mechanism for the declarative delivery tool in GitOps for Kubernetes Argo CD lies in the absence of restrictions on authentication attempts when processing the defaultMaxCacheSize parameter. Exploiting this vulnerability allows a malicious actor to bypass security...

CVE-2024-2464

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...

CVE-2024-2464 Application users enumeration in CDeX

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...

CVE-2024-2464

This CVE concerns CDeX: a flaw in the password-recovery flow that reveals whether a given user exists by differences in the returned messages. The Red Hat entries describe that an attacker could use this to perform a targeted brute-force attack against valid usernames, with affected versions list...

CDeX 安全漏洞

CDeX is a free software package from CDeX Inc. for extracting digital audio from audio CDs and converting audio formats for Microsoft Windows. A security vulnerability exists in CDeX 5.7.1 and earlier versions that originated from allowing an attacker to conduct a brute force attack against a val...

CVE-2022-47036

Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware,...

CVE-2022-47036

Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware,...

CVE-2022-47036

CVE-2022-47036 affects Siklu TG Terragraph devices before ~2.1.1. A hardcoded root password was revealed via a brute-force attack on an MD5 hash and can be used for a (admin) debug login. The vulnerability is not fixed by firmware 2.1.1; remediation is to move to newer hardware (which would typic...

CVE-2024-26001

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26000

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

Input validation

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

Input validation

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26001 PHOENIX CONTACT: Out of bounds write only memory access

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26001

Phoenix Contact CHARX SEC series devices (e.g., CHARX SEC-3100/CHARX SEC-3000 family) are affected by a vulnerability in the MQTT stack where improper input validation allows an unauthenticated, remote attacker to write memory out of bounds. The issue is described as a buffer/length validation fl...

CVE-2024-26001 PHOENIX CONTACT: Out of bounds write only memory access

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26000

CVE-2024-26000 affects Phoenix Contact CHARX SEC-3100 devices due to an out-of-bounds read in the MQTT stack caused by improper input validation. An unauthenticated remote attacker can read memory, with memory randomization reducing brute-force effectiveness. Multiple connected sources confirm th...

CVE-2024-26000 PHOENIX CONTACT: Out of bounds read only memory access

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26000 PHOENIX CONTACT: Out of bounds read only memory access

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...