11608 matches found
Missing brute force protection on cloud federation sharing
None...
PT-2022-22597 · Raneto · Raneto
Name of the Vulnerable Software and Affected Versions: Raneto version 0.17.0 Description: The issue is related to weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. Recommendations: For version 0.17.0, update to version 0.17.1, which contain...
Nextcloud 安全漏洞
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud versions prior to 22.2.9, 23.0.6, and 24.0.2, which stems from an attacker being able to brute-force find out ...
PT-2022-20543 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.7 Nextcloud Server versions prior to 23.0.4 Nextcloud Server versions prior to 24.0.0 Description: The issue concerns the audit log in Nextcloud Server, which is used to track actions but was not proper...
Renato 安全漏洞
Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0 that stems from the use of weak passwords, which can be exploited by an attacker to crack a user's password via a brute-force...
PT-2022-20541 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.9 Nextcloud Server versions prior to 23.0.6 Nextcloud Server versions prior to 24.0.2 Description: The issue affects Nextcloud server, an open source personal cloud solution. An attacker could brute for...
Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=GOTMLS-settings&GOTMLSdebug=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%281%29%3B%3E Also possible with th...
LibreOffice < 7.2.7 / 7.3 < 7.3.3 Multiple Vulnerabilities (Windows)
According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.3. It is, therefore, affected by multiple vulnerabilities: - LibreOffice supports the storage of passwords for web connections in the user's configuration database. The stored...
LibreOffice < 7.2.7 / 7.3 < 7.3.3 Multiple Vulnerabilities (macOS)
According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.3. It is, therefore, affected by multiple vulnerabilities: - LibreOffice supports the storage of passwords for web connections in the user's configuration database. The stored...
CVE-2022-35925
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
Authentication flaw
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
CVE-2022-35925
CVE-2022-35925 affects BookWyrm prior to version 0.4.5, where authentication views lacked rate limiting, enabling brute-force attacks. The Red Hat/Red Hat-linked and other databases confirm the same issue. Root cause: missing rate limiting on login/auth endpoints. Impact (as stated): potential fo...
CVE-2022-35925 Missing rate limit in Authentication in bookwyrm
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
CVE-2022-35925 Missing rate limit in Authentication in bookwyrm
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
CVE-2022-35925 Missing rate limit in Authentication in bookwyrm
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...
No password brute-force protection on login page
Description The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible password combination without any restriction. Proof of Concept 1. 1 - Send a login request of the target user POST http://localhost:3000/api/access-tokens...
PT-2022-23031 · Bookwyrm · Bookwyrm
Name of the Vulnerable Software and Affected Versions: BookWyrm versions prior to 0.4.5 Description: BookWyrm, a social network for tracking reading, has an issue where versions prior to 0.4.5 lack rate limiting on authentication views. This lack of rate limiting allows for brute-force attacks. T...
BookWyrm 授权问题漏洞
BookWyrm is a social reading platform. Versions of BookWyrm prior to 0.4.5 suffer from an authorization issue vulnerability that stems from its lack of rate limiting for authentication views, leading to allowing an attacker to perform a brute force cracking attack...
