PT-2020-19286

Name of the Vulnerable Software and Affected Versions ZTE ZXONE 19700 SNPE ZTE ZXONE 8700 V1.40R2B13 SNPE Description The issue is related to improper access control due to a lack of authentication protection mechanism in the program. This allows attackers to potentially gain access rights throug...

CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies

The US Cybersecurity and Infrastructure Security Agency CISA issued a new advisory on Monday about a wave of cyberattacks carried by Chinese nation-state actors targeting US government agencies and private entities. "CISA has observed Chinese Ministry of State Security-affiliated cyber threat...

PT-2020-19285

Name of the Vulnerable Software and Affected Versions ZTE ZXIPTV version 5.09.08.04 ZTE ZXIPTV-WEB version 5.09.08.04 Description The issue is related to cryptographic problems where the encryption algorithm is not used properly. This could allow remote attackers to perform account credential...

LY Corporation: Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)

IDOR vulnerability at gdc.game.line.me allowed unauthenticated users to perform brute-force attacks to disclose unauthorized files related to service testing and QA...

Magecart’s Success Paves Way For Cybercriminal Credit Card 'Sniffer' Market

The Magecart threat group has dominated headlines for its use of malicious JavaScript code, which is injected into e-commerce websites to exfiltrate customer payment card data. But new research points to a growing industry on underground forums where so-called “sniffers” are being advertised, sol...

Incident Response Analyst Report 2019

Download full report PDF As an incident response service provider, Kaspersky delivers a global service that results in global visibility of adversaries cyber-incident tactics and techniques used in the wild. In this report, we share our teams conclusions and analysis based on incident responses a...

CVE-2019-20031

NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface TUI, effectively allowing brute force attacks...

PT-2020-10324

Name of the Vulnerable Software and Affected Versions NEC UM8000 versions all known software versions NEC UM4730 versions all known software versions NEC non-InMail voicemail systems versions all known software versions Description The issue allows for an infinite number of login attempts in the...

CVE-2020-14484

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

Authentication flaw

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...

CVE-2020-14494

OpenClinic GA is affected (versions 5.09.02 and 5.89.05b) by CVE-2020-14494, an authentication mechanism with insufficient complexity that may allow unauthorized access after a fixed number of attempts. The ICS advisory also notes multiple authentication-related issues and, in practice, indicates...

Unspecified vulnerability in Venki Supravizio BPM (CNVD-2021-17753)

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 10.1.2, which stems from the program not limiting the number of authentication attempts. An attacker can use this vulnerability to conduct brute force...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA...

PT-2020-10845

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description The issue concerns the mishandling of brute-force attacks against Multi-Factor Authentication MFA in the affected software. Recommendations For versions prior to 5.8.0, update to version...

PonyFinal Ransomware Targets Enterprise Servers Then Bides Its Time

A Java-based ransomware known as PonyFinal has galloped onto the scene, targeting enterprise systems management servers as an initial infection vector. According to a warning on Twitter from Microsoft Security Intelligence on Wednesday, PonyFinal is not an automated threat, but rather has humans...

CVE-2020-8790

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 has weak password requirements combined with improper restriction of excessive authentication attempts, which could allow a remote attacker to discover user credentials and obtain access via a brute force attack...

Debian DLA-2187-1 : radicale security update

Radicale, a simple calendar and addressbook server - daemon, is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 8 'Jessie', this problem has been fixed in version 0.9-1+deb8u2. We recommend that you upgrade your radicale packages...

CVE-2019-17525

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

Design/Logic Flaw

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

CVE-2019-17525

CVE-2019-17525 concerns the login page of the D-Link DIR-615 T1 with firmware 20.10, where an issue allows remote attackers to bypass CAPTCHA protection and perform brute-force login attempts. The connected sources confirm a CAPTCHA bypass vulnerability on DIR-615 T1 20.10, enabling credential br...