11615 matches found
The Age of Collaborative Security: What Tens of Thousands of Machines Witness
Disclaimer: This article is meant to give insight into cyber threats as seen by the community of users of CrowdSec. What can tens of thousands of machines tell us about illegal hacker activities? Do you remember that scene in Batman - The Dark Knight, where Batman uses a system that aggregates...
CrackQL - GraphQL Password Brute-Force And Fuzzing Utility
CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. How it works? CrackQL works by automatically batching a single GraphQL...
CVE-2022-31234
Dell EMC PowerStore, contains an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are...
U.S. Dept Of Defense: IDOR on ███████ [HtUS]
Hello, I have found an endpoint in ███ is vulnerable to IDOR which leads an attacker to brute-force an delete Companies Steps to reproduce: 1. Nevgaite to https://███████/████/Reception/Vendor and create account 2. Once you created an account go to https://████/████/Vendor/Companies 3. Regsiter a...
U.S. Dept Of Defense: Account takeover on ███████ [HtUS]
Hello, I have found an endpoint in ████████ is vulnerable to Account takeover Steps to reproduce: 1. Create 2 accounts Attacker A and vicitm B 2. Log in to all of them and go to https://███████/███████/EditUserProfile with attacker's account 3. Now fill out the password with your password 4. Chan...
Information Disclosure
github.com/heroiclabs/nakama is vulnerable to information disclosure. The vulnerability exists because the unsuccessful login attempts on the console are not properly restricted which allows an attacker to make brute-force attacks and gain access to user account details...
Email enumeration via Reset password page
Description Through the Reset password page, an attacker can know that if an email exists or not; just by observing the notification in the response page. So, once the attacker knows that an email exists, he can launch a brute force attack against it. If an email exists: The notification will be ...
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
Input validation
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
CVE-2022-2321
CVE-2022-2321 affects the Nakama console (heroiclabs/nakama). The vulnerability arises from an improper restriction of excessive authentication attempts , enabling brute-force login attempts on the console. Affected condition is stated as Nakama prior to version 3.13.0. The available sources cons...
CVE-2022-2321 Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
Weak Password Policy
Description This application commafeed is using a weak password policy. Acunetix was able to guess the credentials required to access this page. A weak password is short, common, a system default, or something that could be rapidly guessed by executing a brute force attack using a subset of all...
The vulnerability of the Wi-Fi router software WS7200-10, related to the improper implementation of authentication algorithms, allows attackers to circumvent existing security restrictions through brute-force attacks.
The vulnerability of the Wi-Fi router software WS7200-10 is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through brute-force attacks...
Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers
A cloud threat actor group tracked as 8220 has updated its malware toolset to breach Linux servers with the goal of installing crypto miners as part of a long-running campaign. "The updates include the deployment of new versions of a crypto miner and an IRC bot," Microsoft Security Intelligence...
CVE-2022-22487
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...
CVE-2022-22487
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...
Design/Logic Flaw
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...
CVE-2022-22487
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...
CVE-2022-22487
IBM Spectrum Protect Server and its storage agent are affected by CVE-2022-22487, a brute-force login flaw that allows unlimited login attempts to the storage agent without locking the admin ID. This enables a remote attacker to potentially gain unauthorized administrative access to both the stor...