CVE-2024-9928

A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports onl...

PT-2024-39943 · Nsd570 · Nsd570

Name of the Vulnerable Software and Affected Versions: NSD570 affected versions not specified Description: A vulnerability exists in the login panel of NSD570 that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the...

The vulnerability of the microprogrammed software of the D-Link DSL6740C modem, related to the display of the WiFi password, allows a intruder to execute a brute-force attack.

The vulnerability of D-Link DSL6740C modem’s microprogramming software lies in the fact that the default Wi-Fi password is displayed during network scanning. Exploiting this vulnerability allows a remote attacker to execute a brute-force attack...

CVE-2024-10869

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

CVE-2024-10869 GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

CVE-2024-10869

CVE-2024-10869 : GuardGiant WordPress plugin “WordPress Brute Force Protection – Stop Brute Force Attacks” is vulnerable to Reflected Cross-Site Scripting due to improper escaping of add_query_arg/remove_query_arg in versions up to and including 2.2.6. Affected plugin: WordPress Brute Force Prote...

CVE-2024-10869 GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

WordPress plugin WordPress Brute Force Protection 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin WordPress Brute Force...

WordPress GuardGiant Brute Force Protection plugin <= 2.2.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin WordPress Brute Force Protection – Stop Brute Force Attacks versions = 2.2.6...

WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.6 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Brute Force Protection – Stop Brute Force Attacks Type Plugin Vulnerable versions = 2.2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10869 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership...

CVE-2024-52307

CVE-2024-52307 affects the open-source identity provider authentik. A non-constant time comparison on the per-tenant/endpoint path "/-/metrics/" enables brute-forcing the SECRET_KEY used to authenticate that endpoint. The metrics endpoint serves Prometheus data and is not intended for public acce...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

PT-2024-35168

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.8.5 authentik version 2024.10.3 Description The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the SECRET KEY used to...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

CVE-2024-11318

An IDOR Insecure Direct Object Reference vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint...

CVE-2024-11318

CVE-2024-11318 describes an IDOR vulnerability in AbsysNet v2.3.1 where a remote attacker can obtain an active user’s session by brute-forcing the session identifier on the /cgi-bin/ocap/ endpoint. Root cause: insecure direct object reference allowing session hijacking. Impact (per sources): pote...

CVE-2024-11318 IDOR vulnerability in AbsysNet

An IDOR Insecure Direct Object Reference vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint...

AbsysNET 安全漏洞

AbsysNET is an open source library online management system from Library Technology Guides. A security vulnerability exists in AbsysNet version 2.3.1, which stems from an insecure direct object reference that allows an attacker to obtain an unauthenticated user session by brute-force attacking th...

PT-2024-9175 · Absysnet · Absysnet

Name of the Vulnerable Software and Affected Versions: AbsysNet version 2.3.1 Description: An IDOR Insecure Direct Object Reference vulnerability has been discovered, which could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifi...