11607 matches found
CVE-2022-2198
CVE-2022-2198 affects the WPQA Builder WordPress plugin prior to 5.7. The issue is an authorization bug: any logged-in user can read another user’s private messages by guessing the message id, due to missing access checks. Impact is disclosure of private messages; the advisory does not quantify b...
CVE-2022-2198 WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced...
CVE-2021-3513
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality...
CVE-2021-3513
CVE-2021-3513 affects Keycloak/Red Hat Single Sign-On; root cause is a wrong error message during credential entry that enables brute-force attempts even with permanent lockout. Impact is confidentiality. Connected docs confirm the issue and reference security advisories, but do not provide expli...
WordPress plugin WPQA Builder 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...
PT-2022-10443 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Redhat Keycloak affected versions not specified Description: A flaw in the software allows a brute force attack to be possible, even when the permanent lockout feature is enabled. This is due to an...
Security Bulletin: Vulnerability in account lockout affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8964)
Summary IBM License Metric Tool ILMT v9.x and IBM BigFix Inventory BFI v9.x were allowing attacker to conduct brute force dictionary attacks to bypass authentication due to a missing account lockout mechanism. The issue has been fixed in version 9.2.8. Vulnerability Details CVEID: CVE-2016-8964...
Metasploit Wrap-Up
Advantech iView NetworkServlet Command Injection This week Shelby Pace has developed a new exploit module for CVE-2022-2143. This module uses an unauthenticated command injection vulnerability to gain remote code execution against vulnerable versions of Advantech iView software below 5.7.04.6469...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Business Services Fabric (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)
Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Business Services Fabric. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability...
CVE-2022-34615
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...
CVE-2022-34615
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...
Design/Logic Flaw
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...
CVE-2022-34615
Mealie 1.0.0beta3 is associated with multiple CVEs affecting authentication controls: CVE-2022-34615: weak password requirements enable brute-force attacks to potentially gain unauthorized access to the application. Root cause stated as insufficient password strength checks. CVE-2022-34621: an In...
CVE-2022-34615
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...
CVE-2022-34615
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...
Mealie 安全漏洞
Mealie is a self-hosted recipe manager and meal planner by Hayden Individual Developers in the United States. A security vulnerability exists in Mealie version 1.0.0beta3, which stems from the use of weak passwords, allowing an attacker to gain unauthorized access to the application via a brute...
Apache OpenOffice < 4.1.13 Multiple Vulnerabilities
The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.13. It is, therefore, affected by multiple vulnerabilities: - Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted wi...
The vulnerability of the OctoPrint 3D-printer controller, related to insufficient limits on authentication attempts, allows a perpetrator to circumvent existing security restrictions through brute-force attacks.
The vulnerability of the OctoPrint 3D-printer controller relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...
CVE-2022-26307
A flaw was found in LibreOffice, where the master key was poorly encoded, resulting in weakening its entropy from 128 to 43 bits. This issue makes the stored passwords that are encrypted with a single master key provided by the user vulnerable to a brute force attack if an attacker has access to...
OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...