CVE-2021-38474

CVE-2021-38474 concerns InHand Networks IR615 Router. The vulnerability is in the login page where there is no account lockout policy, enabling brute-force attempts to gain valid credentials for the product interface. Affected versions, per public records, include IR615 Router versions 2.3.0.r472...

Trickbot module descriptions

Trickbot aka TrickLoader or Trickster, is a successor of the Dyre banking Trojan that was active from 2014 to 2016 and performed man-in-the-browser attacks in order to steal banking credentials. Trickbot was first discovered in October 2016. Just like Dyre, its main functionality was initially th...

mailman -- brute-force vuln on list admin password, and CSRF vuln in releases before 2.1.35

Mark Sapiro reports: A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. A CSRF attack via the user options page could allow takeover of a users...

in zmister2016/mrdoc

description Use of Cryptographically Weak Pseudo-Random Number Generator PRNG in Mrdoc allows an attacker to reset arbitrary user‘s password 1、/admin/sendemailvcode/，check email & generate email & send mail def sendemailvcoderequest: if request.method == 'POST': email = request.POST.get'email',No...

Shopify: Bypass a fix for report #708013

Summary: customerAccessTokenCreate mutation in the Storefront API does not correctly throttle login attempts. An issue in similar report https://hackerone.com/reports/708013 was already fixed, however, there is still a bypass. Steps To Reproduce: 1. Grab a Storefront API Token I got it from the B...

CVE-2021-38474

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. Th...

CVE-2021-38400

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password...

Hardcoded credentials

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password...

CVE-2021-38400 Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password...

CVE-2021-38400

CVE-2021-38400 affects Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120. Vulnerability: password hash stored/used with insufficient computational effort, allowing a physically proximate attacker with access to remove the device’s hard drive or craft a USB to extract th...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

UBUNTU-CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

Default credentials

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

CVE-2021-39899

Removed by vendor...

CVE-2021-39899

CVE-2021-39899 affects GitLab CE/EE (all versions). An attacker with physical access to a user’s machine can brute-force the user’s password via the change password function. There is a rate limit, but the attack may succeed by stealing the session_id from the compromised account and distributing...

PT-2021-22745 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE affected versions not specified Description: An attacker with physical access to a user's machine may brute force the user's password via the change password function. Although there is a rate limit in place, the attack can still...