Unrestricted file upload

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

CVE-2022-24688

CVE-2022-24688 affects DSK DSKNet 2.16.136.0 and 2.17.136.5. The issue allows unrestricted file upload via PDF content that uses a PHP extension, enabling Remote Code Execution. An attacker must obtain privileged access to the Parameters page (via Broken Access Control with brute-force or SQL Inj...

CVE-2022-24688

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

CVE-2022-2457

A flaw was found in Business Central in Red Hat Process Automation Manager 7. This flaw allows an attacker to benefit from a brute force attack in the Administration Console. In this issue, the application does not limit the number of unsuccessful login attempts...

CVE-2022-31142

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

Email enumeration via Reset password page

Description Through the Reset password page, an attacker can know that if an email exists or not; just by observing the notification in the response page. So, once the attacker knows that an email exists, he can launch a brute force attack against it. If an email exists: The notification will be ...

CVE-2022-22487

An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...

Design/Logic Flaw

An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...

CVE-2022-22487

IBM Spectrum Protect Server and its storage agent are affected by CVE-2022-22487, a brute-force login flaw that allows unlimited login attempts to the storage agent without locking the admin ID. This enables a remote attacker to potentially gain unauthorized administrative access to both the stor...

CVE-2022-22487

An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...

Security Bulletin: IBM Spectrum Protect Server vulnerable to offline dictionary and brute force attacks (CVE-2022-22496, CVE-2022-22487)

Summary The IBM Spectrum Protect Server is vulnerable to an offline dictionary attack when using SESSIONSECURITY=TRANSITIONAL. The IBM Spectrum Protect Storage agent is vulnerable to a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrati...

CVE-2022-31273

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

CVE-2022-31273

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

Code injection

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

CVE-2022-31273

The vulnerability CVE-2022-31273 affects TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp. The issue enables brute-force attacks via a crafted session_id cookie, as documented in multiple sources (NVD/Red Hat). The cited impact in the CVE metrics indicates high confidentiality, integ...

CVE-2022-31273

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

PT-2022-3486 · Schneider Electric · Conext Combox

Name of the Vulnerable Software and Affected Versions: Conext ComBox All Versions Description: The issue is related to insufficient restriction of excessive authentication attempts, which could allow a remote attacker to bypass security restrictions using a brute force attack. This is due to the...

TOPSEC TopIDP 3000 安全漏洞

TOPSEC TopIDP 3000 is an intrusion prevention system from China Tianrongxin TOPSEC. TOPSEC TopIDP 3000 tos3.3.005.656b tos3.3.005.662p has a security vulnerability, which can be exploited by an attacker to perform a brute force attack via sessionid...

CVE-2022-31273: Improper Restriction of Excessive Authentication Attempts

An issue in TopIDP3000 Topsec Operating System tos3.3.005.665b.15smpidp allows attackers to perform a brute-force attack via a crafted sessionid cookie...

Debian DLA-3049-1 : mailman - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3049 advisory. - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. CVE-2021-43331 - In GNU Mailman...