PT-2023-5668 · 3S Smart Software Solutions · Codesys Development System

Name of the Vulnerable Software and Affected Versions: CODESYS Development System versions prior to 3.5.19.20 Description: The issue is related to a missing Brute-Force protection in the CODESYS Development System, which allows a local attacker to have unlimited attempts at guessing the password...

The vulnerability of SAP BusinessObjects Business Intelligence platform, related to insufficient restrictions on authentication attempts, allows attackers to circumvent existing security restrictions through brute-force attacks.

The vulnerability of SAP BusinessObjects Business Intelligence platform is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through brute-force attacks...

Moxa IKS, EDS Improper Restriction of Excessive Authentication Attempts (CVE-2019-6524)

Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Moxa EDS-G516E and EDS-510E Series Ethernet Switches Weak Password Requirements (CVE-2020-6991)

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Moxa EDR-810 Web Server Weak Cryptography for Passwords (CVE-2017-12129)

An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them. This plugin only works with Tenable.ot. Please visit...

Moxa MGate Authentication Bypass (CVE-2016-5804)

Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value. This plugin only works with...

MOXA NPort IAW5000A-I/O Series Improper Restriction of Excessive Authentication Attempts (CVE-2020-25196)

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Moxa NPort Improper Restriction of Excessive Authentication Attempts (CVE-2016-9366)

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

CVE-2023-33562

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-33562

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

Design/Logic Flaw

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

PHPJabbers Time Slots Booking Calendar Security Vulnerability

PHPJabbers Time Slots Booking Calendar is a booking system from PHPJabbers. A security vulnerability exists in PHPJabbers Time Slots Booking Calendar version v3.3, which originated from a vulnerability that allows an attacker to determine if a user is valid via user enumeration, leading to a brut...

CVE-2023-33562

CVE-2023-33562 concerns PHP Jabbers Time Slots Booking Calendar v3.3. The issue is a user-enumeration flaw occurring during the password-recovery flow, where messages differ between valid and invalid usernames, enabling an attacker to determine valid users and potentially perform a brute-force lo...

PT-2023-24388 · Phpjabbers · Php Jabbers Time Slots Booking Calendar

Name of the Vulnerable Software and Affected Versions: PHP Jabbers Time Slots Booking Calendar version 3.3 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or...

CVE-2023-33562

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-33562

User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods

The P2PInfect peer-to-peer P2 worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet. "The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security...

The vulnerability of the ColdFusion software platform, related to insufficient limits on authentication attempts, allows attackers to circumvent existing security restrictions.

The vulnerability of the ColdFusion software platform is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...

GHSA-3V6J-V3QC-CXFF Denial of service from unlimited password lengths

TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities...

Denial of service from unlimited password lengths

TL;DR This vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities...