11590 matches found
CVE-2023-33562
User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...
New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods
The P2PInfect peer-to-peer P2 worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet. "The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security...
The vulnerability of the ColdFusion software platform, related to insufficient limits on authentication attempts, allows attackers to circumvent existing security restrictions.
The vulnerability of the ColdFusion software platform is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...
GHSA-3V6J-V3QC-CXFF Denial of service from unlimited password lengths
TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities...
Denial of service from unlimited password lengths
TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities...
CVE-2023-38492 Kirby vulnerable to denial of service from unlimited password lengths
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still...
Hackers Target Apache Tomcat Servers for Mirai Botnet and Crypto Mining
Misconfigured and poorly secured Apache Tomcat servers are being targeted as part of a new campaign designed to deliver the Mirai botnet malware and cryptocurrency miners. The findings come courtesy of Aqua, which detected more than 800 attacks against its Tomcat server honeypots over a two-year...
PT-2023-26473 · Kirby · Kirby
Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 Description: The issue affects Kirby sites with user accounts, unless Kirby's API an...
GO-2023-1914 Brute-force of token secrets in github.com/superfly/tokenizer
Brute-force of token secrets in github.com/superfly/tokenizer...
CVE-2023-3548
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack...
CVE-2023-3548
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack...
Authentication flaw
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack...
CVE-2023-3548 IQ Wifi 6
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack...
CVE-2023-3548 IQ Wifi 6
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack...
CVE-2023-3548
CVE-2023-3548 affects Johnson Controls IQ Wifi 6 firmware versions prior to 2.0.2. The vulnerability is described as an improper restriction of excessive authentication attempts (CWE-307) that could allow an unauthorized user to gain account access via a brute-force authentication attack over the...
PT-2023-25220 · Iq Wifi 6 · Iq Wifi 6
Name of the Vulnerable Software and Affected Versions: IQ Wifi 6 versions prior to 2.0.2 Description: An unauthorized user could gain account access by conducting a brute force authentication attack. Recommendations: For IQ Wifi 6 versions prior to 2.0.2, update to version 2.0.2 or later to resol...
Cisco NX-OS Software system login block-for Denial of Service (CVE-2021-1590)
A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service DoS condition. This vulnerability is due to a logic error in the...
Johnson Controls IQ Wifi 6 安全漏洞
Johnson Controls IQ Wifi 6 is a series of WiFi devices from Johnson Controls, Inc. A security vulnerability previously existed in Johnson Controls IQ Wifi 6 version 2.0.2, which stemmed from a brute force authentication attack that could be used by an unauthorized user to gain access to an accoun...
Exploit for Weak Password Requirements in I-Doit
CVE-2023-37756 – Weak Password Requirement in admin-center lea...
PenTales: Testing Security Health for a Healthcare Company
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...