CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

Default credentials

Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

Design/Logic Flaw

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18986

Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

CVE-2019-18985 affects Pimcore prior to version 6.2.2, where there is no brute-force protection for the 2FA token. The vulnerability arises from missing rate-limiting on 2FA attempts, enabling offline-like or automated brute force toward 2FA tokens, potentially allowing account compromise. The CV...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18986

Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...

CVE-2019-18986

CVE-2019-18986 concerns Pimcore prior to version 6.2.2. The issue enables an attacker to enumerate valid usernames by abusing the forgot-password flow, which returns distinct messages for invalid passwords versus non-existent users. Root cause in the public descriptions is an information-disclosu...

CVE-2019-18986

Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...

Broadcom Brocade SANnav Security Management Issues Vulnerabilities

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in Broadcom Brocade SANnav versions prior to 2.0. A remote attacker could exploit the vulnerability to brute-force break a valid session ID...

CVE-2019-18986: Improper Restriction of Excessive Authentication Attempts

Pimcore before 6.2.2 allow attackers to brute-force guess valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users...

CVE-2019-18985: Improper Restriction of Excessive Authentication Attempts

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

PT-2019-15741

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.2.2 Description The issue allows attackers to brute-force valid usernames by utilizing the 'forgot password' functionality. This is possible because the functionality returns distinct messages for invalid passwords...

PT-2019-15740

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.2.2 Description The issue lacks brute force protection for the 2FA token. Recommendations For versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue...

TYPO3 Encryption Problem Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions prior to 4.3.4 and 4.4.x prior to 4.4.1. An attacker can exploit the vulnerability to brute-force hash values...

PunBB 1.4.4 Database Disclosure

From https://j.ludost.net/blog/archives/2019/11/11/minorsecurityissueinpunbbwithsqlite/index.html Minor security issue in punbb with SQLite Georgi Guninski security advisory 76, 2019 Running punbb-master from https://github.com/punbb/punbb from Thu 07 Nov 2019 11:23:33 AM UTC Installing on...

CVE-2019-16205

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...