Design/Logic Flaw

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them...

CVE-2020-11821

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them...

CVE-2020-11821

The CVE-2020-11821 entry concerns Rukovoditel 2.5.2, where usernames and passwords are stored in cookies using URL encoding, base64 encoding, and hashing. The root cause is insecure credential handling in cookies, enabling an attacker to perform brute-force attacks to recover credentials. The con...

CVE-2020-11821: Insufficiently Protected Credentials

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them...

PT-2020-12870

Name of the Vulnerable Software and Affected Versions Rukovoditel version 2.5.2 Description The issue concerns the storage of users' passwords and usernames in a cookie, which uses URL encoding, base64 encoding, and hashing. This makes it possible for an attacker to apply brute force on them...

Debian DLA-2187-1 : radicale security update

Radicale, a simple calendar and addressbook server - daemon, is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 8 'Jessie', this problem has been fixed in version 0.9-1+deb8u2. We recommend that you upgrade your radicale packages...

Protecting your organization against password spray attacks

When hackers plan an attack, they often engage in a numbers game. They can invest significant time pursing a single, high-value target—someone in the C-suite for example and do “spear phishing.” Or if they just need low-level access to gain a foothold in an organization or do reconnaissance, they...

CVE-2019-9506 Encryption Key Negotiation of Bluetooth (KNOB) Vulnerability

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks aka "KNOB" that can decrypt traffic and inject arbitrary...

Unspecified Vulnerability in D-Link DIR-615

The D-Link DIR-615 is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the login page of the D-Link DIR-615 T1 version 20.10. A remote attacker can exploit the vulnerability to bypass the CAPTCHA protection mechanism and conduct a brute force attack...

CVE-2019-17525

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

CVE-2019-17525

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

Design/Logic Flaw

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

CVE-2019-17525

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

CVE-2019-17525

CVE-2019-17525 concerns the login page of the D-Link DIR-615 T1 with firmware 20.10, where an issue allows remote attackers to bypass CAPTCHA protection and perform brute-force login attempts. The connected sources confirm a CAPTCHA bypass vulnerability on DIR-615 T1 20.10, enabling credential br...

Nextcloud: No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page.

Hi. I checked the "https://nextcloud.com" page, and try to go to wp-admin page. Then, I found the login page "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" In this page, I tried to login more than 10 times!manually I think that I can try to brute force to this login...

CVE-2019-17525: Improper Restriction of Excessive Authentication Attempts

The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks...

PT-2020-9914

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 T1 version 20.10 Description The issue allows remote attackers to bypass the CAPTCHA protection mechanism on the login page, enabling them to conduct brute-force attacks. Recommendations For D-Link DIR-615 T1 version 20.10,...

X (Formerly Twitter): 暴力破解用户密码没有速率控制

http://www.twitter.com的登录功能存在一个问题，只限制了单个用户尝试登录系统的错误次数，并不限制用固定的密码去尝试登录不同用户，或者是撞库 请您跟着视频操作，否则无法复现到此问题 Impact 暴力破解用户密码没有速率控制...

[SECURITY] [DLA 2178-1] awl security update

Package : awl Version : 0.55-1+deb8u1 CVE ID : CVE-2020-11728 CVE-2020-11729 Debian Bug : 956650 Following CVEs were reported against the awl source package: CVE-2020-11728 An issue was discovered in DAViCal Andrews Web Libraries AWL through 0.60. Session management does not use a sufficiently...

Attacks on Linksys Routers Trigger Mass Password Reset

UPDATE Home Linksys router users were targeted in a cyberattack that changed router settings, and redirected requests for specific webpages and domains to malicious Coronavirus-themed landing pages that were booby-trapped with malware. Researchers identified the attack last month, and earlier thi...