11553 matches found
CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...
Qnap QTS Inadequate Encryption Strength (CVE-2023-34971)
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following...
CVE-2024-45272
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...
CVE-2024-45272
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...
CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...
CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...
CVE-2024-45272
CVE-2024-45272 describes an unauthenticated remote brute-force attack against the credentials of the Remote Service Portal, leading to connection loss with a high likelihood of success (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The available connected documents corroborate a credential brut...
A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.
...
Helmholz REX200/250 安全漏洞
The Helmholz REX200/250 is a wireless router from Helmholz. A security vulnerability exists in the Helmholz REX200/250 versions prior to 5.1.11, which originates from an unauthenticated, remote attacker who can brute-force the credentials of the Remote Services Portal, resulting in a loss of...
PT-2024-39559 · WordPress · Apppresser
Name of the Vulnerable Software and Affected Versions: The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.4 Description: The issue is related to privilege escalation via account takeover. This is due to the appp reset password and validate reset password...
jose4j: denial of service via specially crafted JWE
A flaw was found in the jose.4.j jose4j library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down...
PT-2024-31527 · Unknown · Remote Service Portal
Name of the Vulnerable Software and Affected Versions: Remote Service Portal affected versions not specified Description: An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection loss...
PT-2024-35447 · Unknown · Password Pusher
Name of the Vulnerable Software and Affected Versions: Password Pusher versions prior to v1.49.0 Description: The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially...
How Hybrid Password Attacks Work and How to Defend Against Them
Threat actors constantly change tactics to bypass cybersecurity measures, developing innovative methods to steal user credentials. Hybrid password attacks merge multiple cracking techniques to amplify their effectiveness. These combined approaches exploit the strengths of various methods,...
CVE-2024-48942
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
CVE-2024-48942
The Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid...
Siemens SENTRON PAC Meter Authentication Error Vulnerability
The SENTRON PAC Meter is a power measurement device for precise energy management and transparent information acquisition. An authentication error vulnerability exists in the Siemens SENTRON PAC Meter, which can be exploited by an attacker to bypass authentication via brute force attack or by...
CVE-2024-7293
In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a password brute forcing attack is possible through weak password requirements...
CVE-2024-48942
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions 3.1.4.5 and earlier) is affected. The vulnerability allows remote attackers to brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint, with the last 30 tokens and the next 30 token...
PT-2024-38242 · Progress · Telerik Report Server
Name of the Vulnerable Software and Affected Versions: In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.806 Description: A password brute forcing attack is possible through weak password requirements. Recommendations: For versions prior to 2024 Q3 10.2.24.806, update to version...