1238 matches found
CVE-2023-31135
CVE-2023-31135 affects Dgraph audit logs due to nonce collisions in the log encryption scheme. The first 12 bytes come from a baseIv, and the last 4 bytes from the log line length; because log lines often share the same length, nonces are reused. All audit logs generated by versions
PT-2023-23169 · Dgraph · Dgraph
Name of the Vulnerable Software and Affected Versions: Dgraph versions prior to v23.0.0 Description: Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is...
CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware
Poorly managed Microsoft SQL MS SQL servers are the target of a new campaign that's designed to propagate a category of malware called CLR SqlShell that ultimately facilitates the deployment of cryptocurrency miners and ransomware. "Similar to web shell, which can be installed on web servers,...
Microsoft: You're already using the last version of Windows 10
Microsoft issued a client roadmap update on Thursday to remind us once again that Windows 10 support is slowly coming to an end. In less than three years, all Windows 10 users will need to have moved to Windows 11. While moving to Windows 11 should be a win for security, some Windows 10 fans may ...
Brute Force Attack
flaskappbuilder is vulnerable to Brute Force Attacks. The vulnerability exists due to a lack of rate limiting which allows an attacker to brute force the user credentials and perform unauthorized actions...
CVE-2023-26756
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features...
Design/Logic Flaw
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks...
CVE-2023-26756
CVE-2023-26756 : Revive Adserver version 5.4.1 login page is vulnerable to brute force attacks. The description notes this is effectively mitigated by rate limiting and password-quality features implemented by the vendor. Connected sources corroborate a brute-force vulnerability on the login page...
CVE-2023-26756
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features...
Fortinet Fortigate (FG-IR-22-444)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-444 advisory. - An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 throug...
Authentication flaw
An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...
CVE-2022-43947
An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...
Anti brute-force bypass in administrative interface
...
PT-2023-7425 · Fortinet · Fortiproxy +1
Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.0 through 7.2.3 FortiOS versions prior to 7.0.10 FortiProxy versions 7.2.0 through 7.2.2 FortiProxy versions prior to 7.0.8 Description: The issue is related to an improper restriction of excessive authentication attempts...
CVE-2022-43947: Improper Restriction of Excessive Authentication Attempts
An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...
CVE-2023-29005 No Rate Limiting on Login AUTH DB
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTHRATELIMITED = True, RATELIMITENABLED = True, and setting an AUTHRATELIMIT...
GHSA-5VJ8-G3QG-4QH6 X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header...
PT-2023-22004 · Nextcloud +1 · Nextcloud Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.0 through 24.0.10 Nextcloud Server versions 25.0.0 through 25.0.4 Nextcloud Server Enterprise versions 23.0.0 through 23.0.12.5 Nextcloud Server Enterprise versions 24.0.0 through 24.0.10 Nextcloud Server...
PT-2023-17154 · Linagora · Linagora/Twake
Name of the Vulnerable Software and Affected Versions: linagora/twake version prior to 0.0.0. Description: The issue concerns an improper restriction of excessive authentication attempts. This means that the system does not adequately limit the number of login attempts, potentially allowing for...