12626 matches found
CVE-2023-43623
A vulnerability has been identified in Mendix Forgot Password Mendix 10 compatible All versions V5.4.0, Mendix Forgot Password Mendix 7 compatible All versions V3.7.3, Mendix Forgot Password Mendix 8 compatible All versions V4.1.3, Mendix Forgot Password Mendix 9 compatible All versions V5.4.0...
CVE-2023-43623
A vulnerability has been identified in Mendix Forgot Password Mendix 10 compatible All versions V5.4.0, Mendix Forgot Password Mendix 7 compatible All versions V3.7.3, Mendix Forgot Password Mendix 8 compatible All versions V4.1.3, Mendix Forgot Password Mendix 9 compatible All versions V5.4.0...
PHPJabbers Appointment Scheduler Security Vulnerability
PHPJabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and booking meeting schedules from PHPJabbers Serbia. A security vulnerability exists in PHPJabbers Appointment Scheduler version v3.0, which stems from a discrepancy in messages that could allow an...
CVE-2023-36127
CVE-2023-36127 concerns PHPJabbers Appointment Scheduler version 3.0, where during password recovery a discrepancy in response messages can reveal whether a username exists. This user enumeration enables an attacker to identify valid accounts and potentially perform brute-force attempts against t...
Siemens Mendix Forgot Password Module
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
Siemens Mendix 安全漏洞
The Mendix Forgot Password module allows your users to register your application or reset their own passwords without administrator involvement. A vulnerability exists in the Siemens Mendix Forgot Password module that can be exploited by an attacker to determine if a user is valid, allowing a bru...
CVE-2023-36127
User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...
PT-2023-25439 · Phpjabbers · Phpjabbers Appointment Scheduler
Name of the Vulnerable Software and Affected Versions: PHPJabbers Appointment Scheduler version 3.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not,...
CVE-2023-36127
User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...
Huawei HarmonyOS Security Vulnerability
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a brute-force vulnerability in the device authentication module. Successful exploitatio...
WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR
Description The plugin does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced PoC 1. Create a private folder that contains a file that you intend keep secret. 2. Add the plugin shortcode...
Huawei HarmonyOS Security Vulnerability
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a brute-force vulnerability in the device authentication module. Successful exploitatio...
GitHub: Invite tokens have Insufficient entropy in GHES Management Console
An insufficient entropy vulnerability in GitHub Enterprise Server invitation tokens allowed brute force attacks against pending user invitations to the management console. This affected all versions since 3.8 and was fixed in 3.8.12, 3.9.7, 3.10.4, and 3.11.1...
The vulnerability of the Weincloud industrial device management cloud platform lies in its insufficient authentication attempt limit, which allows attackers to execute a brute-force attack.
The vulnerability of the Weincloud industrial device management cloud platform lies in the insufficient limitation on authentication attempts. Exploiting this vulnerability allows a malicious actor to execute a brute-force attack...
The vulnerability of the CODESYS Development System, a programming platform for embedded systems, lies in its insufficient authentication attempts limitation. This allows attackers to make an unlimited number of password input attempts.
The vulnerability of the CODESYS Development System, a programming platform for embedded systems, is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows attackers to perform an unlimited number of password input attempts...
DRUPAL-CONTRIB-2023-048
This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks. A previous security advisory,...
Cisco Adaptive Security Appliance Software Remote Access VPN Unauthorized Access - Brute Force Attack (cisco-sa-asaftd-ravpn-auth-8LyfCkeC)
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations. This vulnerability is due to improper separation o...
SAP BusinessObjects Business Intelligence Platform Authentication Bypass (3320702)
The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by an authentication bypass vulnerability. SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to ...
LDAP Login Scanner
This module attempts to login to the LDAP service. Module Options msf use auxiliary/scanner/ldap/ldaplogin msf auxiliaryldaplogin show actions ...actions... msf auxiliaryldaplogin set ACTION msf auxiliaryldaplogin show options ...show and set options... msf auxiliaryldaplogin run This module...
GHSA-H3QF-V68R-35JG Economizzer user enumeration vulnerability
The commit 3730880 April 2023 and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or...