GHSA-W82P-R9VW-4RG5 WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validateusername setting. This behavior allows malicious actor...

CVE-2025-1396

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validateusername setting. This behavior allows malicious actor...

CVE-2025-1396

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validateusername setting. This behavior allows malicious actor...

PT-2025-39521

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description A username enumeration issue exists when Multi-Attribute Login is enabled. The system provides a different response for existing and non-existing usernames, regardless of the validate...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2025-36064

CVE-2025-36064 affects IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0–3.1.0.22. The root cause is an inadequate account lockout setting that could permit a remote attacker to brute‑force credentials. IBM’s bulletin (and related sources) list a CVSS v3.1 base score of 5.9 (NEU...

CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

Security Bulletin: IBM Sterling Connect:Express for Microsoft Windows is vulnerable to brute force password guessing attacks (CVE-2025-36064)

Summary There is a vulnerability related to brute force password guessing attacks in IBM Sterling Connect:Express for Microsoft Windows. IBM Sterling Connect:Express for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-36064 DESCRIPTION: IBM Sterling...

CVE-2025-35041

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

CVE-2025-35041 Airship AI Acropolis MFA insufficient rate limiting

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

CVE-2025-35041 Airship AI Acropolis MFA insufficient rate limiting

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

CVE-2025-35041

Airship AI Acropolis MFA vulnerability: after a valid login, there is no rate limiting for MFA attempts, allowing unlimited tries within a 15-minute window to brute-force the 6-digit code. Affected versions include those prior to 10.2.35, 11.0.21, and 11.1.9. Remediation is to upgrade to 10.2.35,...

Airship AI MFA bypass and default credentials vulnerabilities

RISK EVALUATION Airship AI Acropolis is used for video and data management. In versions before 11.1.9, 11.0.21, and 10.2.35, a remote unauthenticated attacker with valid credentials can brute force the MFA code and authenticate without an additional authentication method. Improperly configured...

SonicWall Releases Advisory for Customers after Security Incident

SonicWall released a security advisory to assist their customers with protecting systems impacted by the MySonicWall cloud backup file incident. SonicWall’s investigation found that a malicious actor performed a series of brute force techniques against their MySonicWall.com web portal to gain...

CVE-2025-10658

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers ...

Airship AI Acropolis 安全漏洞

Airship AI Acropolis is a video and wear Blue Flag data management platform from Airship AI in the United States. A security vulnerability exists in Airship AI Acropolis versions prior to 10.2.35, prior to 11.0.21, and prior to 11.1.9, which stems from allowing unlimited attempts at MFA...

IBM Sterling Connect:Express for Microsoft Windows 安全漏洞

IBM Sterling Connect:Express for Microsoft Windows is a secure file transfer gateway software from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22, which stems from an insufficient account...