CVE-2024-43042

Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...

Siemens SINEC Traffic Analyzer Logic Flaw Vulnerability (CNVD-2024-35433)

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communications between controllers and IO devices. A logic flaw vulnerability exists in Siemens SINEC Traffic Analyzer, which stems from the application not properly limiting the number of authentication attempts,...

Siemens Location Intelligence Weak Password Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. Siemens Location Intelligence suffers from a weak password vulnerability that can be exploited by attackers to conduct...

Siemens Location Intelligence Logic Flaw Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. A logic flaw vulnerability exists in Siemens Location Intelligence that stems from not enforcing a limit on too many...

Defending Against a Login API Brute Force Attack

...

CVE-2024-41904

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V2.0. The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate use...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-38888

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts...

HackerOne: IDOR Vulnerability at AddTagToAssets operation name

The IDOR vulnerability was discovered in the AddTagToAssets operation name of a GraphQL endpoint. The vulnerability allowed an attacker to obtain the IDs of custom tags created by a victim by decoding the base64-encoded tagId parameter in the request. This revealed the format and pattern of the t...

GHSA-WMX7-PW49-88JX Craft CMS Allows TOTP Token To Stay Valid After Use

Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times t...

The vulnerability of the SAML standard implementation in the Splunk Enterprise platform for operational analysis allows a perpetrator to carry out a brute-force attack.

The vulnerability of the SAML standard implementation in the Splunk Enterprise platform for operational analysis is related to inconsistencies in responses to incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack...

PT-2024-9098

Name of the Vulnerable Software and Affected Versions: xrdp versions prior to 0.10.0 Description: xrdp is an open source RDP server that has a vulnerability allowing attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configurati...

‘RockYou2024’: Nearly 10 billion passwords leaked online

On a popular hacking form, a user has leaked a file that contains 9,948,575,739 unique plaintext passwords. The list appears to be a compilation of passwords that were obtained during several old and more recent data breaches. The list is referred to as RockYou2024 because of its filename,...

Brute Force Attack

ezsystems/ezplatform-user is vulnerable to Brute Force Attack. The vulnerability is due to the password reset functionality not having sufficient protections against brute force attacks, allowing attackers to repeatedly attempt different passwords to gain unauthorized access to user accounts...

CVE-2023-25646 Permission and Access Control Vulnerability in ZTE H388X

There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations...

CVE-2023-25646

CVE-2023-25646 concerns an unauthorized-access flaw in the ZTE H388X router (ZXHN H388X). Descriptions cite brute-force serial-port cracking that could enable attackers with ordinary user permissions to perform operations to obtain elevated privileges. Documents consistently name a physical attac...

CentOS 7 : ipa (RHSA-2024:3760)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3760 advisory. - A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's session key. This key is different for each new session,...

CVE-2024-33373

An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack...