11615 matches found
CVE-2024-0759 Collection of internally resolving IPs
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...
CVE-2024-0759 Collection of internally resolving IPs
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...
CVE-2024-24721
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
CVE-2024-24721
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
Design/Logic Flaw
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
CVE-2024-0436
Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the !== used for comparison. The risk is minified by the additional overhead of the request, which varies in a...
Design/Logic Flaw
Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the !== used for comparison. The risk is minified by the additional overhead of the request, which varies in a...
Innovaphone PBX Security Breach
Innovaphone PBX is an advanced and modern IP phone system from Innovaphone. A security vulnerability exists in Innovaphone PBX versions prior to 14r1, which stems from the vulnerability of passwords used for authentication to brute force attacks...
WyreStorm Apollo VX20 Security Vulnerability
Wyrestorm Apollo VX20 is an advanced conferencing video device from Wyrestorm. A security vulnerability exists in Wyrestorm Apollo VX20 prior to version 1.3.58, which stems from the TELNET service prompting for a password after a valid username is entered, allowing brute force attacks on valid...
CVE-2024-24721
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
CVE-2024-24721
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...
CVE-2024-24721
The CVE concerns Innovaphone PBX before version 14r1, where the authentication password form is vulnerable to brute-force attacks, potentially allowing an attacker to access the administration panel. The available documents confirm the affected product and the basic exploit vector but do not prov...
CVE-2024-0436 Prevent timing attack for single-user password check
Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the !== used for comparison. The risk is minified by the additional overhead of the request, which varies in a...
Timing Attack
gradio is vulnerable to Timing Attack. The vulnerability is due to string comparisons in Python terminating early upon encountering a string mismatch. This allows an attacker to take advantage of the default lack of rate-limiting, to brute-force the correct username and password of an account...
OESA-2024-1195 python-jwcrypto security update
Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service DoS attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can resul...
CVE-2024-1104
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...
Design/Logic Flaw
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...
CVE-2024-1104 Temporary denial of service during a brute force attack
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...
CVE-2024-1104
CVE-2024-1104 affects AREAL Topkapi security platform, specifically Webserv2. The vulnerability arises from a bypass of the brute-force protection mechanism, enabling an unauthenticated remote attacker to disturb the webservice for all users. Reports from multiple sources (Topkapi-related CVE ent...