Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to...

Unspecified Vulnerability in Schneider Electric Easergy T300 (CNVD-2021-21476)

The Schneider Electric Easergy T300 is a remote terminal unit for the power industry from Schneider Electric, France. A security vulnerability in the Schneider Electric Easergy T300 using firmware version 1.5.2 and earlier, which arises from the program not limiting the number of authentication...

CVE-2020-7508

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

CVE-2020-7511

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to acquire a password by brute force...

CVE-2020-7508

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

CVE-2020-7511

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to acquire a password by brute force...

Authentication flaw

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

CVE-2020-7508

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

CVE-2020-7511

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to acquire a password by brute force...

CVE-2020-7511

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to acquire a password by brute force...

CVE-2020-7508

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

CVE-2020-7511: Use of a Broken or Risky Cryptographic Algorithm

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to acquire a password by brute force...

CVE-2020-7508: Improper Restriction of Excessive Authentication Attempts

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to gain full access by brute force...

Greenhouse.io: SSH port on store.greenhouse.io is vulnerable to brute force attacks

Open SSH port found on third party vendor...

Imperva Takes on its Largest Recorded Account Takeover Attack on a Single Company

Imperva recently detected and mitigated the largest - and most concentrated - series of brute force ATO account takeover attacks in its history. Over the course of 60 hours from midnight on October 28, our ATO team’s monitoring systems detected more than 44 million ATO attempts on the login page ...

The vulnerability of the BruteForceProtector component of the Keycloak identity and access management software allows a hacker to gain unauthorized access to protected information.

The software for managing identities and access control in Keycloak is vulnerable due to errors in configuring the “Conditional OTP Authentication Flow”. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations lies in the improper limitation on the number of unsuccessful authentication attempts. This allows a perpetrator to gain full access.

The vulnerability of the microprogrammed control module software for automation of transformer substations in Schneider Electric Easergy T300 HU250 is related to an improper limitation on the number of unsuccessful authentication attempts. Exploiting this vulnerability can allow a malicious actor...

CVE-2020-13872

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

Authentication flaw

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

CVE-2020-13872

CVE-2020-13872 affects Royal TS before version 5. The root issue is a 0.0.0.0 listener that enables attackers to bypass tunnel authentication via brute-force. Documented impact aligns with bypass of authentication for SSH tunnels, with CVSS3.1 indicating high impact on confidentiality, integrity,...