2765 matches found
CVE-2021-3513
CVE-2021-3513 affects Keycloak/Red Hat Single Sign-On; root cause is a wrong error message during credential entry that enables brute-force attempts even with permanent lockout. Impact is confidentiality. Connected docs confirm the issue and reference security advisories, but do not provide expli...
Default credentials
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...
CVE-2022-2822 Authentication Bypass by Primary Weakness in octoprint/octoprint
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...
CVE-2022-37401 Apache OpenOffice Weak Master Keys
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from...
Design/Logic Flaw
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts...
PT-2022-16724 · Red Hat · Red Hat Process Automation Manager
Name of the Vulnerable Software and Affected Versions: Red Hat Process Automation Manager version 7 Description: A flaw was found in the software where an attacker can benefit from a brute force attack against the Administration Console, as the application does not limit the number of unsuccessfu...
PT-2022-22867 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows for privilege escalation. Zammad has a mechanism to prevent brute-force attacks by invalidating users after a configurable number of attempts to guess login credentials. However, an attacker...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1- Send a login request of the target user POST http://localhost:5000/api/account/login...
Account Takeover [namelessmc.com]
Description: 1. Hello team, while i was testing on https://namelessmc.com/login/ i noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field Steps to reproduce: 1. 1- go to https://namelessmc.com/login/ 2. 2- Ente...
CVE-2022-35143
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks...
Renato 安全漏洞
Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0 that stems from the use of weak passwords, which can be exploited by an attacker to crack a user's password via a brute-force...
LibreOffice < 7.2.7 / 7.3 < 7.3.3 Multiple Vulnerabilities (macOS)
According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.3. It is, therefore, affected by multiple vulnerabilities: - LibreOffice supports the storage of passwords for web connections in the user's configuration database. The stored...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1 - Send a login request of the target user POST http://localhost:3000/api/access-tokens...
BookWyrm 授权问题漏洞
BookWyrm is a social reading platform. Versions of BookWyrm prior to 0.4.5 suffer from an authorization issue vulnerability that stems from its lack of rate limiting for authentication views, leading to allowing an attacker to perform a brute force cracking attack...
PT-2022-23296 · Bf-Os · Bf-Os
Name of the Vulnerable Software and Affected Versions: BF-OS versions 3.x up to and including 3.83 Description: The issue allows a remote attacker to brute-force the device password due to the lack of strong password enforcement. Recommendations: For BF-OS versions 3.x up to and including 3.83,...
CVE-2022-26307
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...
CVE-2022-26307
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...
Design/Logic Flaw
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...