CVE-2024-3461

KioWare for Windows versions all through 8.35 allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number...

Critical F5 Central Manager Vulnerabilities Allow Enable Full Device Takeover

Two security vulnerabilities have been discovered in F5 Next Central Manager that could be exploited by a threat actor to seize control of the devices and create hidden rogue administrator accounts for persistence. The remotely exploitable flaws "can give attackers full administrative control of...

PT-2024-26004 · Unknown · Kioware For Windows

Name of the Vulnerable Software and Affected Versions: KioWare for Windows versions all through 8.35 Description: The issue allows an attacker to escape the environment by downloading PDF files, which are then opened in an external PDF viewer. This can lead to launching a web browser, searching...

PT-2024-26025 · Unknown · Kioware For Windows

Name of the Vulnerable Software and Affected Versions: KioWare for Windows versions all through 8.35 Description: The issue allows for brute forcing the PIN number that protects the application from being closed, due to the lack of mechanisms preventing excessive guessing of the number...

The vulnerability of the AVerCaster video encoding device lies in its insufficient attempt-limiting mechanism, which allows attackers to execute a brute-force attack.

The vulnerability of the AVerCaster video encoding device is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a remote attacker to execute an attack using brute-force methods...

Anti-Malware Security and Brute-Force Firewall < 4.23.56 - Unauthenticated Remote Code Execution

Description The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.21.96 due to weak nonce generation combined with missing authorization. This makes it possible for unauthenticated attackers to brute...

CVE-2024-4601

An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute force attack on the application and recover a valid session, because the application uses a five-digit integer value...

CVE-2024-4601 Improper Authentication vulnerability in Socomec Net Vision

An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute force attack on the application and recover a valid session, because the application uses a five-digit integer value...

CVE-2024-4601

CVE-2024-4601 affects Socomec Net Vision (version 7.20) and is described as an improper authentication vulnerability. The root cause is the use of five‑digit integer values, which enables a brute‑force attack to recover a valid session. Multiple connected records (CNVD/CNNVD/NVD variants) corrobo...

CVE-2024-4601 Improper Authentication vulnerability in Socomec Net Vision

An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute force attack on the application and recover a valid session, because the application uses a five-digit integer value...

Socomec Net Vision 授权问题漏洞

Socomec Net Vision is a network management solution developed by SOCOMEC for its Uninterruptible Power Supply UPS products to remotely monitor, condition manage and automate the operation of UPS. An authentication vulnerability exists in Socomec Net Vision, which stems from the application's use ...

What can we learn from the passwords used in brute-force attacks?

Brute force attacks are one of the most elementary cyber threats out there. Technically, anyone with a keyboard and some free time could launch one of them -- just try a bunch of different username and password combinations on the website of your choice until you get blocked. Nick Biasini and I...

GHSA-XFQ4-78J7-V594 Passbolt Browser Extension leaks password information

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

Passbolt Browser Extension leaks password information

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2024-33668

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to...

PT-2024-25425 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.3.0 Description: An issue was discovered where the Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. This could allow an attacker to brute force these IDs and upload malicious conte...

CVE-2024-33668

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...