12130 matches found
Code injection
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...
CVE-2021-27943
The CVE-2021-27943 entry describes a brute-force vulnerability in the pairing procedure of Vizio P65-F1 (firmware 6.0.31.4-2) and E50x-E1 (firmware 10.0.31.4-2) TVs/mobile apps. An attacker can test up to 10,000 pairing possibilities to force device pairing, potentially enabling remote control of...
CVE-2021-27943
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...
in postfixadmin/postfixadmin
✍️ Description uniqid is used as input to MD5 when generating a PFATOKEN I'll refer to this as a session token - the function uniqid is not a CSPRNG but rather is a PRNG meaning that it cannot generate cryptographically reliable/secure values. 🕵️♂️ Proof of Concept Execute the below code: PHP "; ?...
Cerbrutus - Network Brute Force Tool, Written In Python
Modular brute force tool written in Python, for very fast password spraying SSH, and FTP and in the near future other network services. COMING SOON: SMB, HTTPs POST, HTTPs GET, HTTP BASIC AUTH Thanks to @0dayctf, Rondons, Enigma, and 001 fortesting and contributing Installation: cd /opt git clone...
Tennessee Valley Authority: Rate limit missing sign-in page
Vulnerability description not provided...
in erudika/scoold
✍️ Description You should check and validate the password when users registering, any user able to use a weak password like aaaaa also you don't have any rate limit for incorrect passwords that cause to easily perform Bruteforce attacks against your users that have weak passwords. 💥 Impact This...
Insecure Access Controls
github.com/argoproj/argo-cd uses insecure access controls. The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-brute-force measures. An attacker is able to repeatedly perform authentication attempts to discover user credentials...
Rockstar Games: Brute Force against VMware Horizon
In this report, the researcher discovered a VMWare Horizon admin remote access login portal that was publicly accessible and not sufficiently protected against credential stuffing/brute force attacks. No user accounts were breached; all employees are required to use MFA to login through such...
Exploit for Off-by-one Error in Sudo_Project Sudo
CVE-2021-3156 PoC Introdução Este é um exploit para o CV...
in kestasjk/webdiplomacy
✍️ Description According to previous explanation about weak cryptographic tokens, you also send the same weak token to users that forgot their passwords. here an attacker can also do Bruteforce attacks to take control of users accounts. 🕵️♂️ Proof of Concept...
None in firefly-iii/firefly-iii
Improper Restriction of Excessive Authentication Attempts. The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks. STEPS FOR REPRODUCTION: 1Go to...
CVE-2020-23283
Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force...
CVE-2020-23283
Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force...
Information disclosure
Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force...
CVE-2020-23283
Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force...
CVE-2020-23283
CVE-2020-23283 affects MV mConnect application v02.001.00 and enables information disclosure on the login page, allowing an attacker to determine valid users from the application’s database via brute force. Red Hat and other connected records corroborate the logon-page information disclosure; CNN...
MV mConnect application SQL注入漏洞
MV mConnect application is a software application. A SQL injection vulnerability exists in the MV mConnect application, which can be exploited to brute-force obtain user information due to a failure to restrict user actions on the product's login page. The following products and versions are...
MV mConnect application SQL注入漏洞
MV mConnect application is a software application. A SQL injection vulnerability exists in the MV mConnect application, which can be exploited to brute-force obtain user information due to a failure to restrict user actions on the product's login page. The following products and versions are...
Dolibarr ERP/CRM 10.0.6 Login Brute Forcer
Exploit Title: Dolibarr ERP/CRM 10.0.6 - Login Brute Force Date:2020-01-18 Exploit Author: Creamy Chicken Soup Vendor Homepage: https://www.dolibarr.org Software Link: https://sourceforge.net/projects/dolibarr/ Version: 10.0.6 Tested on: Windows 10 - 64bit CVE: CVE-2020-7995 function...