CVE-2022-45893

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...

CVE-2022-45893

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...

CVE-2022-45893

Planet eStream (versions prior to 6.72.10.07) has a cookie-based authentication flaw in the ON cookie that can be exploited by a low-privilege user to access administrative and high-privilege accounts. A brute-force attack can compute a value enabling permanent access, effectively compromising co...

CVE-2022-3989

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

Design/Logic Flaw

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

CVE-2022-3989

The Motors WordPress plugin is vulnerable in versions before 1.4.4 due to improper validation of uploaded files for dangerous types (e.g., .php) in an AJAX action. This can allow a user to sign up on a victim WordPress instance, upload PHP payloads, and potentially launch a brute‑force/credential...

CVE-2022-3989 Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types such as .php in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the...

PT-2022-25082 · WordPress · Motors

Name of the Vulnerable Software and Affected Versions: Motors WordPress plugin versions prior to 1.4.4 Description: The issue allows an attacker to upload malicious files, such as .php files, to a WordPress instance due to improper validation of uploaded files in an AJAX action. This can lead to...

Design/Logic Flaw

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

PT-2022-27339 · Seeddms · Seeddms

Name of the Vulnerable Software and Affected Versions: SeedDMS versions 5.1.7 through 6.0.20 Description: The issue is related to weak reset token generation, allowing attackers to execute a full account takeover via a brute force attack. Recommendations: For SeedDMS version 5.1.7, update to a...

CVE-2022-44938

The CVE-2022-44938 issue concerns SeedDMS v6.0.20 and v5.1.7, where weak reset token generation enables full account takeovers via brute force. According to sources (Red Hat, CNNVD/CVELIST, and vulnerability trackers), the vulnerability stems from insufficient randomness/verification in the accou...

PT-2022-27538 · Unknown · Lazy Mouse Server

Name of the Vulnerable Software and Affected Versions: Lazy Mouse server affected versions not specified Description: The issue allows remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands due to weak password requirements and the lack of rate...

CVE-2022-45482

Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

Authentication flaw

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...

CVE-2022-23746

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...

The vulnerability of the OATHAuth extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the OATHAuth extension, a software tool for implementing a hypertext environment like MediaWiki, relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to circumvent existing security measures through...

PT-2022-16247 · Check Point · Check Point Ipsec Vpn Blade

Name of the Vulnerable Software and Affected Versions: Check Point IPsec VPN blade affected versions not specified Description: The issue concerns a brute-force attack vulnerability when the IPsec VPN blade's portal is configured for username/password authentication, allowing attackers to target...

Check Point IPSec VPN 安全漏洞

Check Point IPSec VPN is a suite of VPN Virtual Private Network software based on the IPSec protocol from Check Point, Israel. Check Point IPSec VPN suffers from a security vulnerability that stems from susceptibility to brute force attacks on usernames and passwords...