o365spray

o365spray o365spray est un outil d'énumération d'utilisateurs et de pulvérisation de mots de passe ciblant Microsoft Office 365 O365. Cet outil réimplémente une série de techniques d'énumération et de pulvérisation recherchées et identifiées par les personnes mentionnées dans Remerciements. À des...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

CVE-2026-26744

CVE-2026-26744 Уязвимость перечисления пользователей существует в FormaLMS 4.1.18 и ниже в функциональности восстановления пароля, доступной через конечную точку /lostpwd. Приложение возвращает разные сообщения об ошибках для действительных и недействительных имен пользователей например, «Введённ...

SecureOps-Lab

SecureOps Lab - Évaluation Cybersécurité en Direct Aperçu Réalisé une évaluation cybersécurité en direct sur un serveur Linux universitaire. Lors de l'analyse, une activité d'attaque active a été identifiée, incluant des tentatives d'authentification par force brute et des tentatives d'exploitati...

CVE-2025-65427

CVE-2025-65427: Проблема ограничения скорости аутентификации в Dbit N300 T1 Pro Идентификатор CVE: CVE-2025-65427 Дата: 2025-12-16 Обнаружил: Kirubel Продукт: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Версия прошивки: V1.0.0 Описание Проблема обнаружена в маршрутизаторе Dbit N300 T1 Pro...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-Politique-de-mot-de-passe-faible-dans-HotelDruid-3.0.7 Description Une vulnérabilité dans HotelDruid version 3.0.7 et antérieures permet aux utilisateurs de définir des mots de passe faibles en raison de l'absence de mise en œuvre de politiques de force des mots de passe. Impact Mo...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-21755

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755

HCL Hive is affected by a missing rate limit that could allow an attacker to achieve unauthorized access via brute-force or credential stuffing attacks, or cause a denion of service . The CVSS 3.1 base score is 5.3 (MEDIUM) with a network attack vector, low complexity, and no privileges required....

EUVD-2026-64893

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

PT-2026-80880

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755: Improper Restriction of Excessive Authentication Attempts

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

CVE-2026-68067

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

CVE-2026-66340

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...