11622 matches found
CVE-2022-29084
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access to the system as the victim. Account...
Schneider Electric PowerLogic ION Setup 安全漏洞
Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. A security vulnerability exists in Schneider Electric that ste...
多款Dell产品安全漏洞
Dell Unity and Dell UnityXT are both products of Dell Incorporated Dell, U.S.A. Dell Unity is a set of virtual Unity storage environments.Dell UnityXT is a set of virtual Unity storage environments. A security vulnerability exists in Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to...
Weak Password Requirements
Description Weak password policy leads to successful bruteforce attack Steps to reproduce 1.Go to http://localhost:8083/login and login with default credentials admin/admin123 2.Go to http://localhost:8083/me and change password to 123 3. Noticed that password has been changed successful...
Improper Restriction of Excessive Authentication Attempts in login feature
Description No rate limiting in login form leads to bruteforce attack Steps to reproduce 1.Go to http://localhost:/login 2.Login with wrong credentials 3.Capture POST request with Burp Suite and Send to Intruder 4.Create 100 null payloads and start attack 5.Noticed that all request return 200...
CVE-2022-29245 Weak private key generation in SSH.NET
SSH.NET is a Secure Shell SSH library for .NET. In versions 2020.0.0 and 2020.0.1, during an X25519 key exchange, the client’s private key is generated with System.Random. System.Random is not a cryptographically secure random number generator, it must therefore not be used for cryptographic...
spirit
Spirit - Network Pentest Tools We believe in making the inte...
GHSA-H6R2-PGVX-683C Lin-CMS-Flask vulnerable to Improper Authentication
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...
Lin-CMS-Flask vulnerable to Improper Authentication
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component app/api/cms/user.py...
GHSA-QRF6-H5FC-7M96 Mattermost Server does not enforce rate limits on password change attempts
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...
Mattermost Server does not enforce rate limits on password change attempts
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...
Security Bulletin: Vulnerability in IBM Java SDK Runtime affects DS8000 (CVE-2015-0138)
Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects some versions of DS8000. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in SSL/TLS implementations could allow a remote attacker to downgrade the security of certain...
Pimcore Discloses Usernames In Use
Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...
Pimcore 2FA Vulnerable to Brute Forcing
Pimcore before 6.2.2 lacks brute force protection for the 2FA token...
GHSA-WVR4-W6CW-4PX8 Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Magento 2 Community Edition Cryptographic Flaw
A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks...
Forging Australian Driver’s Licenses
The New South Wales digital drivers license has multiple implementation flaws that allow for easy forgeries. This file is encrypted using AES-256-CBC encryption combined with Base64 encoding. A 4-digit application PIN which gets set during the initial onboarding when a user first instals the...
Microsoft Warns Rise in XorDdos Malware Targeting Linux Devices
A Linux botnet malware known as XorDdos has witnessed a 254% surge in activity over the last six months, according to latest research from Microsoft. The trojan, so named for carrying out denial-of-service attacks on Linux systems and its use of XOR-based encryption for communications with its...
Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices
In the last six months, we observed a 254% increase in activity from a Linux trojan called XorDdos. First discovered in 2014 by the research group MalwareMustDie, XorDdos was named after its denial-of-service-related activities on Linux endpoints and servers as well as its usage of XOR-based...