Nokia Service Router Operating System 安全漏洞

Nokia Service Router Operating System Nokia SR OS is an operating system used by Nokia of Finland for its service router series. A security vulnerability exists in Nokia Service Router Operating System SR OS prior to version 24, which arises from a brute-force attack vulnerability in the bof.cfg...

CISA, FBI, NSA, and International Partners Release Advisory on Iranian Cyber Actors Targeting Critical Infrastructure Organizations Using Brute Force

Today, CISA—with the Federal Bureau of Investigation FBI, the National Security Agency NSA, and international partners—released joint Cybersecurity Advisory Iranian Cyber Actors Brute Force and Credential Access Activity Compromises Critical Infrastructure. This advisory provides known indicators...

Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations

Summary The Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency CISA, the National Security Agency NSA, the Communications Security Establishment Canada CSE, the Australian Federal Police AFP, and Australian Signals Directorate's Australian Cyber Security...

CVE-2024-9305

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

CVE-2024-9305

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

CVE-2024-9305

CVE-2024-9305 (AppPresser – Mobile App Framework, WordPress) affects the AppPresser plugin for WordPress, up to and including version 4.4.4. The root cause is weak access controls in the password-reset flow: appp_reset_password() and validate_reset_password() allow brute-forcing an OTP to change ...

CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...

Qnap QTS Inadequate Encryption Strength (CVE-2023-34971)

An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following...

CVE-2024-45272

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

CVE-2024-45272

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

CVE-2024-45272

CVE-2024-45272 describes an unauthenticated remote brute-force attack against the credentials of the Remote Service Portal, leading to connection loss with a high likelihood of success (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The available connected documents corroborate a credential brut...

CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost...

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

...

Helmholz REX200/250 安全漏洞

The Helmholz REX200/250 is a wireless router from Helmholz. A security vulnerability exists in the Helmholz REX200/250 versions prior to 5.1.11, which originates from an unauthenticated, remote attacker who can brute-force the credentials of the Remote Services Portal, resulting in a loss of...

PT-2024-39559 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.4 Description: The issue is related to privilege escalation via account takeover. This is due to the appp reset password and validate reset password...

jose4j: denial of service via specially crafted JWE

A flaw was found in the jose.4.j jose4j library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down...

PT-2024-31527 · Unknown · Remote Service Portal

Name of the Vulnerable Software and Affected Versions: Remote Service Portal affected versions not specified Description: An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection loss...

PT-2024-35447 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions prior to v1.49.0 Description: The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially...