CVE-2022-3031

An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific...

CVE-2022-40055

An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page...

CVE-2022-3031

CVE-2022-3031 affects GitLab CE/EE, with affected versions: all versions before 15.1.6, all versions from 15.2 before 15.2.4, and all versions from 15.3 before 15.3.2. The issue may allow an attacker to brute-force a user’s password by sending crafted requests to a specific endpoint, even if 2FA ...

CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...

CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...

GoCD 安全漏洞

GoCD is a continuous delivery server. A security vulnerability exists in GoCD versions 19.2.0 through 19.11.0 that stems from the use of regular string comparisons to validate tokens instead of the constant time algorithm, which can be exploited by an attacker to brute-force GoCD server API calls...

Dell EMC XtremIO Brute Force Compromise Vulnerability

Dell EMC XtremIO is an all-flash, horizontally scalable enterprise storage array from Dell, Inc. A brute force vulnerability exists in Dell EMC XtremIO X2 versions prior to 6.4.0-22, which can be exploited by an unauthenticated, remote attacker to gain access to the administrator account...

The vulnerability of the Telnet component of the FortiTester software-defined infrastructure for diagnosing and auditing computer networks allows attackers to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the Telnet component in the software-hardware environment for diagnosing and auditing computer networks, FortiTester, relates to the possibility of executing unauthorized code or commands. Exploiting this vulnerability allows a malicious actor to circumvent existing security...

Default credentials

WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over...

Dell EMC XtremIO 安全漏洞

Dell EMC XtremIO is an all-flash, horizontally scalable enterprise storage array from Dell, Inc. A brute force vulnerability exists in Dell EMC XtremIO X2 versions prior to 6.4.0-22, which can be exploited by an unauthenticated, remote attacker to gain access to the administrator account...

CVE-2022-33106

WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over...

FortiTester - Missing account lockout on telnet port

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

CVE-2022-35846

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

PT-2022-5115 · Dell Emc · Dell Emc Xtremio

Name of the Vulnerable Software and Affected Versions: Dell EMC XtremIO versions prior to X2 6.4.0-22 Description: The issue is related to insufficient authentication attempt limitation, allowing a remote unauthenticated attacker to potentially exploit it and gain access to an admin account throu...

CVE-2022-35846

The CVE-2022-35846 entry covers FortiTester with a flaw in the Telnet port that allows brute-force credential guessing for the admin user due to an improper restriction of excessive authentication attempts. Affected FortiTester versions are 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0. The core issu...

CVE-2022-35846

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

PT-2022-5028 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow an...

GHSA-4993-M7G5-R9HH etcd has no minimum password length

Vulnerability type Access Control Workarounds The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. It is the responsibility of the administrator to enforce these requirements. Detail etcd does not perform any password length...

GHSA-9G3V-V24Q-JJ5P rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts...

rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts...