CVE-2022-26964

The CVE-2022-26964 entry concerns Devolutions Remote Desktop Manager prior to version 2022.1, where weak password derivation for export enables information disclosure via a password brute-force attack. The underlying issue is an error that causes base64 to be decoded, contributing to the weakness...

CVE-2022-26964

Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded...

CVE-2022-26964

Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded...

Design/Logic Flaw

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...

CVE-2022-45893

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...

CVE-2022-45893

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...

CVE-2022-45893

Planet eStream (versions prior to 6.72.10.07) has a cookie-based authentication flaw in the ON cookie that can be exploited by a low-privilege user to access administrative and high-privilege accounts. A brute-force attack can compute a value enabling permanent access, effectively compromising co...

CVE-2022-3989

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

Design/Logic Flaw

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

CVE-2022-3989 Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

CVE-2022-3989

The Motors WordPress plugin is vulnerable in versions before 1.4.4 due to improper validation of uploaded files for dangerous types (e.g., .php) in an AJAX action. This can allow a user to sign up on a victim WordPress instance, upload PHP payloads, and potentially launch a brute‑force/credential...

PT-2022-25082 · WordPress · Motors

Name of the Vulnerable Software and Affected Versions: Motors WordPress plugin versions prior to 1.4.4 Description: The issue allows an attacker to upload malicious files, such as .php files, to a WordPress instance due to improper validation of uploaded files in an AJAX action. This can lead to...

Design/Logic Flaw

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

PT-2022-27339 · Seeddms · Seeddms

Name of the Vulnerable Software and Affected Versions: SeedDMS versions 5.1.7 through 6.0.20 Description: The issue is related to weak reset token generation, allowing attackers to execute a full account takeover via a brute force attack. Recommendations: For SeedDMS version 5.1.7, update to a...

CVE-2022-44938

The CVE-2022-44938 issue concerns SeedDMS v6.0.20 and v5.1.7, where weak reset token generation enables full account takeovers via brute force. According to sources (Red Hat, CNNVD/CVELIST, and vulnerability trackers), the vulnerability stems from insufficient randomness/verification in the accou...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-45482

Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

PT-2022-27538 · Unknown · Lazy Mouse Server

Name of the Vulnerable Software and Affected Versions: Lazy Mouse server affected versions not specified Description: The issue allows remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands due to weak password requirements and the lack of rate...

Authentication flaw

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...