CVE-2024-43042

Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...

CVE-2024-43042: Improper Restriction of Excessive Authentication Attempts

Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack...

CVE-2024-43042

CVE-2024-43042 affects Pluck CMS 4.7.18: the login subsystem does not limit failed attempts, enabling brute-force-style access attempts over the network. Public sources in the connected documents corroborate the issue's existence and classify it as high severity (CVSSv3.1: 9.8, Confidentiality, I...

Siemens Location Intelligence Logic Flaw Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. A logic flaw vulnerability exists in Siemens Location Intelligence that stems from not enforcing a limit on too many...

Siemens Location Intelligence Weak Password Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. Siemens Location Intelligence suffers from a weak password vulnerability that can be exploited by attackers to conduct...

Siemens SINEC Traffic Analyzer Logic Flaw Vulnerability (CNVD-2024-35433)

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communications between controllers and IO devices. A logic flaw vulnerability exists in Siemens SINEC Traffic Analyzer, which stems from the application not properly limiting the number of authentication attempts,...

Defending Against a Login API Brute Force Attack

...

CVE-2024-41904

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V2.0. The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate use...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683: Weak Password Requirements

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

PT-2024-7639

Name of the Vulnerable Software and Affected Versions Location Intelligence versions prior to V4.4 Description The issue is related to weak password requirements in the Location Intelligence software. This could allow an attacker to gain access to confidential data through a brute force attack...

CVE-2024-38888

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts...

HackerOne: IDOR Vulnerability at AddTagToAssets operation name

The IDOR vulnerability was discovered in the AddTagToAssets operation name of a GraphQL endpoint. The vulnerability allowed an attacker to obtain the IDs of custom tags created by a victim by decoding the base64-encoded tagId parameter in the request. This revealed the format and pattern of the t...

GHSA-WMX7-PW49-88JX Craft CMS Allows TOTP Token To Stay Valid After Use

Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times t...

The vulnerability of the SAML standard implementation in the Splunk Enterprise platform for operational analysis allows a perpetrator to carry out a brute-force attack.

The vulnerability of the SAML standard implementation in the Splunk Enterprise platform for operational analysis is related to inconsistencies in responses to incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack...

PT-2024-9098

Name of the Vulnerable Software and Affected Versions: xrdp versions prior to 0.10.0 Description: xrdp is an open source RDP server that has a vulnerability allowing attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configurati...

‘RockYou2024’: Nearly 10 billion passwords leaked online

On a popular hacking form, a user has leaked a file that contains 9,948,575,739 unique plaintext passwords. The list appears to be a compilation of passwords that were obtained during several old and more recent data breaches. The list is referred to as RockYou2024 because of its filename,...

Brute Force Attack

ezsystems/ezplatform-user is vulnerable to Brute Force Attack. The vulnerability is due to the password reset functionality not having sufficient protections against brute force attacks, allowing attackers to repeatedly attempt different passwords to gain unauthorized access to user accounts...