CVE-2019-12784: Cross-Site Request Forgery (CSRF)

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

The vulnerability of the ECOM-3000 data collection and transmission web application lies in the insufficient limitation on authentication attempts. This allows attackers to circumvent existing security restrictions by using brute-force attacks.

The vulnerability of the ECOM-3000 data collection and transmission web application is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...

PT-2020-9340

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered that allows attackers to potentially compromise valid credentials. At the /wfo/control/signin API endpoint, the rd parameter can accept a URL, to which users will be redirect...

PT-2020-9341

Name of the Vulnerable Software and Affected Versions: Verint Impact 360 version 15.1 Description: An issue was discovered where the login form at the /wfo/control/signin API endpoint can accept submissions from external websites. This can be exploited by attackers to crowdsource brute-force logi...

Mail.ru: SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account Takeover

Authentication procedure was not sufficiently protected against bruteforce and allowed arbitrary youdrive.today account takeover...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://api.warrobots.com/auth (Pixonic Games)

Password at warrobots.com was not sufficiently protected against bruteforce...

Unspecified vulnerability in Venki Supravizio BPM

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 10.1.2. An attacker could exploit the vulnerability to determine if a username is valid and then conduct a brute force attack using a valid username...

Unspecified vulnerability in Venki Supravizio BPM (CNVD-2021-17753)

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 10.1.2, which stems from the program not limiting the number of authentication attempts. An attacker can use this vulnerability to conduct brute force...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

Design/Logic Flaw

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

Authentication flaw

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15367

CVE-2020-15367 affects Venki Supravizio BPM 10.1.2 and stems from not limiting authentication attempts on the Login page. This unbounded brute-force risk is evidenced by multiple sources noting an unauthenticated attacker could repeatedly attempt logins. The publicly available materials describe ...

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page...

CVE-2020-15392

CVE-2020-15392 — A user enumeration vulnerability in Venki Supravizio BPM 10.1.2 is triggered during password recovery. The issue arises from differing error messages that let an attacker determine whether a username exists, enabling brute-force use of valid usernames. Connected documents corrobo...

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

CVE-2020-15392: Observable Discrepancy

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames...

PT-2020-14405

Name of the Vulnerable Software and Affected Versions Venki Supravizio BPM version 10.1.2 Description A user enumeration flaw was found in the password recovery process. This issue allows an attacker to determine if a username is valid or not by analyzing the difference in error messages, enablin...