75 matches found
ADFSpray
ADFSpray ADFSpray is a python3 tool to perform password spray attack against Microsoft ADFS. ALWAYS VERIFY THE LOCKOUT POLICY TO PREVENT LOCKING USERS. How to use it First, install the needed dependencies: root@kitploit: pip3 install -r requirements.txt Run the tool with the needed flags:...
patator
Patator Patator는 Hydra, Medusa, Ncrack, Metasploit 모듈 및 Nmap NSE 스크립트를 암호 추측 공격에 사용하면서 느낀 불편함에서 작성되었습니다. 또 다른 무차별 대입 도구를 만들지 않고 동일한 단점을 반복하지 않기 위해 다른 접근 방식을 선택했습니다. Patator는 Python으로 작성된 멀티스레드 도구로, 이전 도구들보다 더 신뢰할 수 있고 유연하게 설계되었습니다. 현재 다음 모듈을 지원합니다: ftplogin : Brute-force FTP sshlogin : Brute-forc...
SSHUsernameBruter-SSHUB
SSHUsernameBruter SSHUB 취약한 OpenSSH 서버에 대해 목록 또는 제공된 사용자 이름을 무차별 대입brute force하고, 사용자 이름/사용자 이름을 로그인 자격 증명으로 시도하는 옵션이 있는 완전한 기능의 스크립트 - CVE-2018-15473...
EUVD-2026-69718
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...
CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...
CVE-2026-84476
WWBN AVideo contains an authentication bypass flaw in its login rate limiting mechanism. The application fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, which are consumed by the enforceRateLimit() function. An unauthenticated, network-based attacker can ...
CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...
PT-2026-84535
Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers. This allows attackers to spoof the client address used by the enforceRateLimit function. By...
PT-2026-82101
Name of the Vulnerable Software and Affected Versions Liderahenk versions prior to 3.5.5 Description Liderahenk contains hard-coded credentials, which allows an attacker to gain access by using common or default usernames and passwords. Recommendations Update Liderahenk to version 3.5.5 or later...
CVE-2026-11922
The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...
CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
PT-2026-61693
Name of the Vulnerable Software and Affected Versions Glance version 0.8.5 Description An IP address spoofing issue exists in the authentication handler when the server proxied option is enabled. Unauthenticated attackers can bypass brute-force lockout protections by providing arbitrary values in...
CVE-2026-60001
A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...
CVE-2026-3329
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints...
CVE-2026-3329 Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints...
CVE-2026-3329 Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints...
EUVD-2026-36268
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints...
CVE-2026-3329
CVE-2026-3329 affects Sonatype Nexus Repository. A remote unauthenticated attacker can perform credential-guessing attacks via authentication endpoints, with a CVSS v4.0 base score 8.7 (HIGH) and network exposure. The vulnerability is characterized by a lack of authentication requirements for gue...
CVE-2026-3329 Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints...