ESC 8832 Unauthorized Access Vulnerability

ESC 8832 is a Web-based SCADA system from ESC Corporation. A security vulnerability exists in ESC 8832 version 3.02 and earlier. A remote attacker can exploit this vulnerability to gain unauthorized access by performing a brute force attack on the parameters...

Multiple I-O DATA DEVICE Product PIN Recovery Vulnerabilities

I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-S, WN-GDN/R3-U, and WN-GDN/R3-C are wireless LAN router products from I-O DATA DEVICE Japan. A security vulnerability exists in several I-O DATA DEVICE products, which allows remote attackers to gain access to the network by performing a brute-force attack to...

New Relic: Missing rate limit on password

Hello, in login page https://login.newrelic.com/login there is no rate limit for brute force attack on password which allow attacker to do as much he can from requests for guessing the user password. the same was happened in Facebook newrelck.pngF93837 Thaanks...

Design/Logic Flaw

The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack...

CVE-2016-1206

The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack...

CVE-2016-1206

CVE-2016-1206 affects I-O DATA DEVICE WN-GDN/R3 series (WN-GDN/R3, R3-C, R3-S, R3-U). The WPS implementation does not limit PIN guesses, enabling a brute-force attack from within wireless range to recover the PIN and gain network access. Public documents from JVN and CNVD confirm this vulnerabili...

CVE-2016-1206

The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack...

Tollgrade Smart Grid EMS LightHouse Vulnerabilities

OVERVIEW Ashish Kamble of Qualys, Inc. has identified vulnerabilities in Tollgrade Communications, Inc.’s Smart Grid LightHouse Sensor Management System SMS Software EMS. Tollgrade has produced a new version to mitigate these vulnerabilities. Ashish Kamble has tested the new version to validate...

CVE-2016-0791

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach...

CVE-2016-0790

Jenkins CVE-2016-0790 affects Jenkins core before 1.650 and LTS before 1.642.2, where API token verification does not use a constant-time algorithm—enabling remote attackers to brute-force tokens. The linked sources confirm this cryptographic weakness and tie it to Jenkins releases prior to these...

Algolia: No rate-limit in Two factor Authentication leads to bypass using bruteforce attack

Hi, There is no rate limit set for Two factor authentication, which demand for code sent to mobile. This code can be bruteforced easily to bypass this. POST /users/testqr HTTP/1.1 Host: www.algolia.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept:...

HackerOne: Web Authentication Endpoint Credentials Brute-Force Vulnerability

Dear, Your web authentication endpoint, https://hackerone.com/sessions POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, it would...

Jenkins < 1.642.2 / 1.650 and Jenkins Enterprise < 1.609.16.1 / 1.625.16.1 / 1.642.2.1 Multiple Vulnerabilities

The remote web server hosts a version of Jenkins that is prior to 1.650, or a version of Jenkins LTS prior to 1.642.2; or else a version of Jenkins Enterprise that is 1.642.x.y prior to 1.642.2.1, 1.625.x.y prior to 1.625.16.1, or 1.609.x.y prior to 1.609.16.1. It is, therefore, affected by the...

CVE-2016-1927

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...

CVE-2015-5010

IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

UBUNTU-CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

CVE-2016-1232

The CVE-2016-1232 issue affects Prosody’s mod_dialback in versions before 0.9.9, where dialback secret tokens were generated with a weak PRNG. This vulnerability can enable spoofing of server-to-server connections via brute force. The Fedora/Debian advisories reference a fix in Prosody 0.9.9 (and...

Samsung SmartTV and Printers Information Disclosure Vulnerability

Samsung SmartTV is a smart TV that combines web content, Apps apps, AllShare content, search functionality, and traditional TV channel listings into a single user interface, and Printers is a smart printing solution. A security vulnerability exists in Samsung SmartTV and Printers that could allow...