10-Year-Old 'RUBYCARP' Romanian Hacker Group Surfaces with Botnet

A threat group of suspected Romanian origin called RUBYCARP has been observed maintaining a long-running botnet for carrying out crypto mining, distributed denial-of-service DDoS, and phishing attacks. The group, believed to be active for at least 10 years, employs the botnet for financial gain,...

Medium: python-jwcrypto

Issue Overview: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service DoS attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denia...

PT-2024-13701 · Stilog · Stilog Visual Planning

Name of the Vulnerable Software and Affected Versions: Stilog Visual Planning version 8 Description: An authentication bypass issue was found, allowing an unauthenticated attacker to brute-force the password reset PINs of administrative users. Recommendations: For Stilog Visual Planning version 8...

Key Lesson from Microsoft's Password Spray Hack: Secure Every Account

In January 2024, Microsoft discovered they'd been the victim of a hack orchestrated by Russian-state hackers Midnight Blizzard sometimes known as Nobelium. The concerning detail about this case is how easy it was to breach the software giant. It wasn't a highly technical hack that exploited a...

CVE-2024-21662

A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a defaultMaxCacheSize of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different...

CVE-2024-21662

CVE-2024-21662 (Argo CD) is a brute-force protection bypass caused by a weak cache-based login attempt tracker. The vulnerability centers on a per-user login attempt cache capped at 1000 entries (defaultMaxCacheSize). An attacker can overload the cache with login attempts for many users, causing ...

CVE-2024-21662 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combine...

Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

Summary An attacker can exploit a chain of vulnerabilities, including a Denial of Service DoS flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This makes the application susceptible to brute force attacks, compromising the security of...

CVE-2024-2051

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form...

CVE-2024-2051

CVE-2024-2051 concerns Schneider Electric Easergy T200 (including SC2-04MOD-07000104 and earlier). The vulnerability arises from an improper restriction of excessive authentication attempts, which could allow an attacker to perform brute-force login attempts and potentially lead to account takeov...

CVE-2024-2051

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form...

PT-2024-2037 · Schneider Electric · Schneider Electric Easergy T200

Name of the Vulnerable Software and Affected Versions: Schneider Electric Easergy T200 affected versions not specified Description: The issue is related to an improper restriction of excessive authentication attempts, which could allow an attacker to conduct brute-force attacks against the login...

Hacked WordPress Sites Abusing Visitors' Browsers for Distributed Brute-Force Attacks

Threat actors are conducting brute-force attacks against WordPress sites by leveraging malicious JavaScript injections, new findings from Sucuri reveal. The attacks, which take the form of distributed brute-force attacks, "target WordPress websites from the browsers of completely innocent and...

Five Eyes Agencies Expose APT29's Evolving Cloud Attack Tactics

Cybersecurity and intelligence agencies from the Five Eyes nations have released a joint advisory detailing the evolving tactics of the Russian state-sponsored threat actor known as APT29. The hacking outfit, also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard formerly Nobelium, a...

Innovaphone PBX Security Breach

Innovaphone PBX is an advanced and modern IP phone system from Innovaphone. A security vulnerability exists in Innovaphone PBX versions prior to 14r1, which stems from the vulnerability of passwords used for authentication to brute force attacks...

PINs for Cryptography with Hardware Secure Elements

I’m a big fan of technologies that enable otherwise impossible security properties and user experiences, like cryptography often can. One such technology is hardware secure elements. Here’s a thing you can’t do with cryptography: encrypt data securely with a low-entropy secret, like a PIN. If a...

AZL-43006 CVE-2023-6681 affecting package python-jwcrypto 0.6.0-9

A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service DoS attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service...

AZL-43009 CVE-2023-6681 affecting package python-jwcrypto 0.6.0-9

A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service DoS attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service...

Wallarm’s Crusade Against Rising Credential Stuffing Threats

Credential Stuffing, a vital yet often overlooked aspect of cybersecurity, needs to be addressed with urgency. An alarmingly large segment of the population engages in the risky habit of using the same password for various accounts. This behavior parallels the risk of using a universal key for...

Feds Warn of AndroxGh0st Botnet Targeting AWS, Azure, and Office 365 Credentials

The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI warned that threat actors deploying the AndroxGh0st malware are creating a botnet for "victim identification and exploitation in target networks." A Python-based malware, AndroxGh0st was fir...