Insecure Authentication Mechanism

portal-impl uses an insecure authentication mechanism. A user account is not locked out after numerous failed authentication attempts, potentially allowing an attacker to discover a user's password via a password brute-force attack. The vulnerability affects users who are not using digest...

X (Formerly Twitter): Private list members disclosure via GraphQL

Summary: Due to improper queries of GraphQL, the attacker can steal members of the private list. Description: Twitter implements a unique GraphQL endpoint, which can use only the queries that Twitter specified. However, there is a flaw in the backend...

PonyFinal Ransomware Targets Enterprise Servers Then Bides Its Time

A Java-based ransomware known as PonyFinal has galloped onto the scene, targeting enterprise systems management servers as an initial infection vector. According to a warning on Twitter from Microsoft Security Intelligence on Wednesday, PonyFinal is not an automated threat, but rather has humans...

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

Awesome-shiro CVE-2016-4437 Shiro=1.2.4 deserialization,...

PT-2020-3698

Name of the Vulnerable Software and Affected Versions MOXA NPort IAW5000A-I/O firmware versions 2.1 and lower Description The issue is related to the implementation of SSH/Telnet protocols in the MOXA NPort IAW5000A-I/O Series web server software, which lacks sufficient restrictions on...

Aviatrix Systems Controller Information Disclosure Vulnerability (CNVD-2020-31575)

Aviatrix Systems Controller is a centralized control panel for business processes and management of Aviatrix Systems solutions from Aviatrix Systems, USA. A security vulnerability exists in Aviatrix Systems Controller prior to version 5.4.1204 that stems from a discrepancy in the response from th...

PT-2020-5203

Name of the Vulnerable Software and Affected Versions CmtViewer affected versions not specified Description The issue is related to the use of an insufficiently secure encryption algorithm in the CmtViewer application for managing programmable panels. Exploitation of this issue may allow an...

CVE-2020-13413

An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force...

CVE-2020-13413

An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force...

CVE-2020-13413

CVE-2020-13413 affects Aviatrix Controller prior to version 5.4.1204. The issue is an observable response discrepancy in the API that makes it easier to enumerate valid usernames via brute force. Public references across multiple feeds describe this information disclosure vulnerability tying to u...

ceph-ansible: hard coded credential in ceph-ansible playbook

A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph...

PT-2021-10078

Name of the Vulnerable Software and Affected Versions: ceph-ansible versions prior to 6.0.0alpha1 Description: A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker c...

URLBrute - Tool To Brute Website Sub-Domains And Dirs

What is this URLBrute is a tool to help you brute forcing website sub-domains and dirs. Can be used with python3 and python2. Dependencies urlbrute.py requests = 2.21.0 bs4 = 0.0.1 datetime = 4.3 How to install In Linux: chmod +x install.sh sudo ./install.sh In Windows, install python 3.7, then r...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-30176)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a security vulnerability that can be exploited by attackers to determine user credentials through a brute force attack on the...

CVE-2020-12752

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 with TEEGRIS software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 May 2020...

CVE-2020-12752

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 with TEEGRIS software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 May 2020...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 with TEEGRIS software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 May 2020...

CVE-2020-12752

CVE-2020-12752 affects Samsung mobile devices running P(9.0)/Q(10.0) with TEEGRIS. The issue allows attackers to determine user credentials via a brute-force attack against the Gatekeeper Trustlet, as described in multiple sources (Samsung ID SVE-2020-16908). The attack surface is the Gatekeeper ...

CVE-2020-12752: Improper Input Validation

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 with TEEGRIS software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 May 2020...

PT-2020-13243

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with P9.0 and Q10.0 with TEEGRIS software Description An issue allows attackers to determine user credentials via a brute-force attack against the Gatekeeper trustlet. Recommendations For Samsung mobile devices with P9.0...