13937 matches found
CVE-2019-3766: Improper Restriction of Excessive Authentication Attempts
Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker may potentially perform a password brute-force attack to gain access to the targeted accounts...
CVE-2019-3746: Improper Restriction of Excessive Authentication Attempts
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system...
Moxa EDS-G516E EDS-510E Authentication Bypass
The vulnerability of the microprogramming software of Moxa EDS-G516E and Moxa EDS-510E switches lies in the lack of restrictions on excessive authentication attempts. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full access to the system by brute-forcing the...
Moxa MGate Embedded Web Server Full Access
The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in the lack of restrictions on excessive authentication attempts. Exploiting this vulnerability allows a malicious actor to gain full access to the...
Moxa PT-7528 Ethernet Switch Authentication Bypass
The vulnerability of the microprogrammed Ethernet switch software of Moxa PT-7528 and Moxa PT-7828 lies in the lack of restrictions on excessive authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions by using brute-force attack...
Insecure Random Number Generation
Apereo Cas is vulnerable to insecure random number generation. Multiple classes relies on weak random numbers generated from org.apache.commons.lang3.RandomStringUtils class, allowing an attacker to easily predict the random number and perform brute force attack...
Logic Flaw Vulnerability in RG-SAM Campus Network Self-Service System
Ruijie RG-SAM authentication and billing management system not only supports the high integration of software and hardware to form a highly available solution, but also adds value-added profit and other functions to provide users with a win-win cooperation solution with a flexible mode of...
Smominru Botnet Indiscriminately Hacked Over 90,000 Computers Just Last Month
Insecure Internet-connected devices have aided different types of cybercrime for years, most common being DDoS and spam campaigns. But cybercriminals have now shifted toward a profitable scheme where botnets do not just launch DDoS or spam—they mine cryptocurrencies as well. Smominru, an infamous...
Siemens SINEMA Remote Connect Server ICSA-19-260-02 Multiple Security Vulnerabilities
Description Siemens SINEMA Remote Connect Server is prone to following security vulnerabilities: 1. Multiple security vulnerabilities 2. An information-disclosure vulnerability 3. A cross-site-request forgery vulnerability An attacker may leverage these issues to obtain potentially sensitive...
QIWI: hard-use account takeover qiwi.com
It was possible to brute force guessable confirmation token id due to an auth flaw...
PT-2019-12335 · Couchbase · Couchbase Server
Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 6.0.0 Description: The issue arises from the insecure generation of a cookie used for intra-node communication in Couchbase Server. Specifically, the erlang:now function is used to seed the PRNG, resulting i...
CVE-2019-16180
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used...
CVE-2019-16180
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used...
Windows NTFS - Privileged File Access Enumeration
Windows NTFS - Privileged File Access Enumeration + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Windows...
Unspecified Vulnerability in Total.js CMS
Total.js CMS is a Node.js content management system. An unspecified vulnerability exists in Total.js CMS 12.0.0, which can be exploited by an attacker to conduct a brute force attack and steal the admin password...
Microsoft Windows NTFS - Privileged File Access Enumeration
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Windows NTFS NTFS is a proprietary journaling file system...
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...
CVE-2019-15955
The CVE-2019-15955 entry describes a vulnerability in Total.js CMS 12.0.0 where a low-privilege user can transform an admin session cookie to reveal random values inside it, enabling brute‑forcing to steal the admin password. Sources across NVD/Red Hat/CVE listings confirm the affected product/ve...
One Identity Defender 5.9.3 Insecure Cryptographic Storage
Title: One Identity Defender - Insecure Cryptographic Storage Date: 01 September 2019 Affected Software: ================== One Identity Defender 5.9.3 Other versions are likely also vulnerable. Insecure Cryptographic Storage: ============================== Defender stores token seeds, PAP secret...