2770 matches found
CVE-2016-0791
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach...
CVE-2016-0790
Jenkins CVE-2016-0790 affects Jenkins core before 1.650 and LTS before 1.642.2, where API token verification does not use a constant-time algorithm—enabling remote attackers to brute-force tokens. The linked sources confirm this cryptographic weakness and tie it to Jenkins releases prior to these...
Algolia: No rate-limit in Two factor Authentication leads to bypass using bruteforce attack
Hi, There is no rate limit set for Two factor authentication, which demand for code sent to mobile. This code can be bruteforced easily to bypass this. POST /users/testqr HTTP/1.1 Host: www.algolia.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept:...
HackerOne: Web Authentication Endpoint Credentials Brute-Force Vulnerability
Dear, Your web authentication endpoint, https://hackerone.com/sessions POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, it would...
Jenkins < 1.642.2 / 1.650 and Jenkins Enterprise < 1.609.16.1 / 1.625.16.1 / 1.642.2.1 Multiple Vulnerabilities
The remote web server hosts a version of Jenkins that is prior to 1.650, or a version of Jenkins LTS prior to 1.642.2; or else a version of Jenkins Enterprise that is 1.642.x.y prior to 1.642.2.1, 1.625.x.y prior to 1.625.16.1, or 1.609.x.y prior to 1.609.16.1. It is, therefore, affected by the...
CVE-2016-1927
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...
CVE-2015-5010
IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...
CVE-2016-1232
The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...
UBUNTU-CVE-2016-1232
The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...
CVE-2016-1232
The CVE-2016-1232 issue affects Prosody’s mod_dialback in versions before 0.9.9, where dialback secret tokens were generated with a weak PRNG. This vulnerability can enable spoofing of server-to-server connections via brute force. The Fedora/Debian advisories reference a fix in Prosody 0.9.9 (and...
CVE-2016-1232
The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...
Samsung SmartTV and Printers Information Disclosure Vulnerability
Samsung SmartTV is a smart TV that combines web content, Apps apps, AllShare content, search functionality, and traditional TV channel listings into a single user interface, and Printers is a smart printing solution. A security vulnerability exists in Samsung SmartTV and Printers that could allow...
IBM HTTP Server SSL/TLS RC4 Stream Cipher Key Invariance (Bar Mitzvah)
According to its banner, the version of IBM HTTP Server running on the remote host is affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A man-in-the-middle...
Belkin N150 Wireless Home Router Insecure Default Password Leakage
Belkin N150 Wireless Home is a wireless router product from Belkin USA. An insecure default password vulnerability exists in the Belkin N150 Wireless Home Router, which can be exploited by attackers to conduct brute force attacks and obtain sensitive information...
Atlassian JIRA < 6.4.10 / 7.0.0-OD-02 MitM Plaintext Disclosure (Bar Mitzvah)
According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 6.4.10 or 7.0.0-OD-02. It is, therefore, potentially affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with...
Kaspersky Anti-Virus Local Information Disclosure Vulnerability
Kaspersky Anti-Virus is a suite of antivirus software developed by the Russian Kaspersky Lab Kaspersky Lab. A local information disclosure vulnerability exists in Kaspersky Anti-Virus. A local attacker could exploit this vulnerability to obtain sensitive information and conduct a brute force atta...
Kaspersky Small Office Security Local Information Disclosure Vulnerability
Kaspersky Small Office Security is a suite of antivirus software for small and medium-sized businesses from Russia's Kaspersky Lab. A local information disclosure vulnerability exists in Kaspersky Small Office Security. A local attacker could exploit this vulnerability to obtain sensitive...
WordPress XML-RPC Brute Force Authentication Bypass Vulnerability
WordPress is a blogging platform developed using the PHP language. WordPress has an authentication bypass vulnerability that allows remote attackers to conduct brute force attacks to bypass the authentication mechanism and perform unauthorized operations...
CVE-2015-3972
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access via a brute-force attack...