CVE-2019-20031: Improper Restriction of Excessive Authentication Attempts

NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface TUI, effectively allowing brute force attacks...

CVE-2020-4567: Improper Restriction of Excessive Authentication Attempts

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156...

CVE-2020-4567

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156...

Mail.ru: Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space

Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary smart.space account takeover...

PT-2020-5346

Name of the Vulnerable Software and Affected Versions TrueConf affected versions not specified Description The issue is related to insufficient password complexity requirements in TrueConf software. This could allow a remote attacker to gain access to a user's account by brute-forcing passwords...

GSA Bounty: Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.gov

Summary: Hello TTS Bug bounty team! I have found data.gov User/admin usernames disclosed. Using REST API, we can see all the WordPress users/author with some of their information. Steps To Reproduce: You can find the information disclosure by going to data.gov/wp-json/wp/v2/users/ Supporting Vide...

CVE-2020-11625

The AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and AvertX Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438 are vulnerable to username enumeration via the web UI. The ISAPI/Security/sessionLogin/capabilities endpoint returns a salt value for existing usernames ...

Exploit for Improper Restriction of Excessive Authentication Attempts in Tiki

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Fr...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at http://terrafoot.ru/login.php (Rate Limit bypass via IP Rotation)

Password at terrafoot.ru was not sufficiently protected against bruteforce...

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

IBM Verify Gateway (IVG) Account Lockout Improperly Set Vulnerability

IBM Verify Gateway IVG is a cloud-based authentication solution from IBM in the United States. An improperly set account lockout vulnerability exists in IBM Verify Gateway IVG. A remote attacker could exploit the vulnerability to brute-force break account credentials...

CVE-2020-4400

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

CVE-2020-4400

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

Code injection

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

CVE-2020-4400

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

PT-2020-18050

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations For versions 1.0.0 and 1.0.1...

CVE-2020-4400: Improper Restriction of Excessive Authentication Attempts

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

CVE-2020-14494

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...

CVE-2020-14484

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

CVE-2020-14494

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts...