GHSA-93X3-M7PW-PPQM Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after t...

PT-2024-24730 · Unknown · Yms Vis Pro

Name of the Vulnerable Software and Affected Versions: YMS VIS Pro versions prior to 3.3.0.7 Description: The issue arises from a combination of an improper method for system credentials generation and a weak password policy, allowing passwords to be easily guessed and enumerated through brute...

CVE-2024-4601

An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute force attack on the application and recover a valid session, because the application uses a five-digit integer value...

CVE-2024-4601

CVE-2024-4601 affects Socomec Net Vision (version 7.20) and is described as an improper authentication vulnerability. The root cause is the use of five‑digit integer values, which enables a brute‑force attack to recover a valid session. Multiple connected records (CNVD/CNNVD/NVD variants) corrobo...

CVE-2024-4601 Improper Authentication vulnerability in Socomec Net Vision

An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute force attack on the application and recover a valid session, because the application uses a five-digit integer value...

HCL Technologies HCL Connections User Enumeration Vulnerability

HCL Technologies HCL Connections is a suite of enterprise collaboration platforms from HCL Technologies. A user enumeration vulnerability exists in HCL Technologies HCL Connections versions 7.0 and 8.0, which can be exploited by an attacker to determine if a user is valid, leading to a brute forc...

CVE-2024-23557

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack...

CVE-2024-23557

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack...

CVE-2024-23557 HCL Connections is vulnerable to a user enumeration vulnerability

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack...

CVE-2024-23557 HCL Connections is vulnerable to a user enumeration vulnerability

HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack...

CVE-2024-23557

Summary: CVE-2024-23557 affects HCL Connections (versions 7.0–8.0). The vulnerability is user enumeration, where certain actions reveal whether a given username exists, enabling brute-force style attacks. What’s affected: HCL Connections core platform; specific versions 7.0–8.0 are cited in conne...

argo-cd: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a defaultMaxCacheSize of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different...

MFA bombing taken to the next level

Simply put, MFA bombing also known as “push bombing” or “MFA fatigue” is a brute force attack on your patience. Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication MFA. MFA normally requires a user to enter a six-digit code sent by SMS, or...

CVE-2023-49232

CVE-2023-49232 affects Stilog Visual Planning 8. An unauthenticated attacker can bypass authentication by brute-forcing administrative password reset PINs, enabling account access via the Visual Planning app. The vulnerability impacts the password-reset flow and can lead to administrative comprom...

The vulnerability of the caching mechanism of the declarative delivery tool for GitOps in Kubernetes Argo CD allows attackers to circumvent security restrictions and execute an brute-force attack.

The vulnerability of the caching mechanism for the declarative delivery tool in GitOps for Kubernetes Argo CD lies in the absence of restrictions on authentication attempts when processing the defaultMaxCacheSize parameter. Exploiting this vulnerability allows a malicious actor to bypass security...

CVE-2024-2464

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...

CVE-2024-2464 Application users enumeration in CDeX

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...

CVE-2024-2464

This CVE concerns CDeX: a flaw in the password-recovery flow that reveals whether a given user exists by differences in the returned messages. The Red Hat entries describe that an attacker could use this to perform a targeted brute-force attack against valid usernames, with affected versions list...

CDeX 安全漏洞

CDeX is a free software package from CDeX Inc. for extracting digital audio from audio CDs and converting audio formats for Microsoft Windows. A security vulnerability exists in CDeX 5.7.1 and earlier versions that originated from allowing an attacker to conduct a brute force attack against a val...

CVE-2022-47036

Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware,...