AbsysNET 安全漏洞

AbsysNET is an open source library online management system from Library Technology Guides. A security vulnerability exists in AbsysNet version 2.3.1, which stems from an insecure direct object reference that allows an attacker to obtain an unauthenticated user session by brute-force attacking th...

CVE-2024-9832

There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...

CVE-2024-9832 No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator

There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...

CVE-2024-9832

CVE-2024-9832 affects the Baxter Life2000 ventilator. The root issue is an unlimited number of login attempts using the Clinician Password or Serial Number Clinician Password, enabling brute-force access to the device. Once compromised, an attacker could modify device settings that may disrupt ve...

CVE-2024-9832 No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator

There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...

Baxter Life2000 Ventilation System

RISK EVALUATION Successful exploitation of these vulnerabilities could lead to information disclosure and/or disruption of the device's function without detection. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying...

PT-2024-39873 · Unknown · Ventilator

Name of the Vulnerable Software and Affected Versions: Ventilator affected versions not specified Description: The issue allows for an unlimited number of failed login attempts with the Clinician Password or the Serial Number Clinician Password. This enables an attacker to perform a brute-force...

SAP NetWeaver AS Java Multiple Vulnerabilities (November 2024)

SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities: - Due to missing authorization check in SAP NetWeaver AS Java System Landscape Directory an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and...

CVE-2024-51558 Brute Force Attack Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

CVE-2024-51558

The CVE-2024-51558 entry concerns Wave 2.0 where the API-based login lacks restrictions on excessive failed authentication attempts. A remote attacker could perform brute-force attempts against OTP, MPIN, or passwords, potentially gaining unauthorized access and compromising other accounts. Conne...

CVE-2024-48271

Summary: CVE-2024-48271 affects the D-Link DSL-6740C family (v6.TR069.20211230). The issue stems from insecure default credentials used for the Administrator account, which could let an attacker bypass authentication and achieve privilege escalation by brute-forcing. This is supported by multiple...

PT-2024-33146 · Unknown · Cloud Smart Lock

Name of the Vulnerable Software and Affected Versions: Cloud Smart Lock version 2.0.1 Description: The issue concerns a leaked URL in the APK file that can be used to call an API for binding physical devices. This allows attackers to construct requests to bind the app to unknown devices by findin...

CVE-2023-6728 Nokia SR OS: BOF File Encryption Vulnerability

Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content...

CVE-2024-9305

CVE-2024-9305 (AppPresser – Mobile App Framework, WordPress) affects the AppPresser plugin for WordPress, up to and including version 4.4.4. The root cause is weak access controls in the password-reset flow: appp_reset_password() and validate_reset_password() allow brute-forcing an OTP to change ...

CVE-2024-45272

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

CVE-2024-45272

CVE-2024-45272 describes an unauthenticated remote brute-force attack against the credentials of the Remote Service Portal, leading to connection loss with a high likelihood of success (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The available connected documents corroborate a credential brut...

PT-2024-39559 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.4 Description: The issue is related to privilege escalation via account takeover. This is due to the appp reset password and validate reset password...

Siemens SENTRON PAC Meter Authentication Error Vulnerability

The SENTRON PAC Meter is a power measurement device for precise energy management and transparent information acquisition. An authentication error vulnerability exists in the Siemens SENTRON PAC Meter, which can be exploited by an attacker to bypass authentication via brute force attack or by...

PT-2024-38242 · Progress · Telerik Report Server

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.806 Description: A password brute forcing attack is possible through weak password requirements. Recommendations: For versions prior to 2024 Q3 10.2.24.806, update to version...