CVE-2025-30236

CVE-2025-30236 affects Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515. A POST request containing a SESSION parameter can bypass the password check and authenticate with a six‑digit TOTP code, enabling potential unauthorized access. The CVSS 3.1 base score is 8.6 (HIGH) with network attack...

Shearwater SecurEnvoy SecurAccess Enrol 安全漏洞

Shearwater SecurEnvoy SecurAccess Enrol is a zero-trust security solution from Shearwater SecurEnvoy. A security vulnerability exists in Shearwater SecurEnvoy SecurAccess Enrol versions prior to 9.4.515, which stems from authentication by only a six-digit TOTP code...

CVE-2025-30236

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code skipping a password check if an HTTP POST request contains a SESSION parameter...

rexml: REXML ReDoS vulnerability

A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between & and x...; in a hex numeric character reference &x...; can trigger a regular expression denial of service ReDoS condition, leading to a denial of service...

PT-2024-7770 · Siemens · Siemens Sentron 7Km Pac3200

Name of the Vulnerable Software and Affected Versions: Siemens SENTRON 7KM PAC3200 All versions Description: A vulnerability has been identified in the Modbus TCP interface of the Siemens SENTRON 7KM PAC3200, where affected devices only provide a 4-digit PIN to protect from administrative access...

RHUB TurboMeeting 安全漏洞

RHUB TurboMeeting is a collaboration solution from RHUB Corp. It provides web conferencing, remote support, audio conferencing, video conferencing, remote access, and webinar support. A security vulnerability exists in RHUB TurboMeeting versions prior to 8.X. The vulnerability stems from the...

CVE-2024-38287

The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value...

PT-2024-25220 · Lb Link · Lb-Link Bl-W1210M

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-W1210M version 2.0 Description: An issue in the LB-LINK BL-W1210M router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This can allow attackers to access the router v...

CVE-2023-7264

The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code...

Socomec Net Vision 授权问题漏洞

Socomec Net Vision is a network management solution developed by SOCOMEC for its Uninterruptible Power Supply UPS products to remotely monitor, condition manage and automate the operation of UPS. An authentication vulnerability exists in Socomec Net Vision, which stems from the application's use ...

PT-2024-2064 · Hitron · Coda-4589 +1

Name of the Vulnerable Software and Affected Versions: Hitron CODA-4582 and CODA-4589 devices affected versions not specified Description: The issue is related to insufficient entropy due to the use of default PSKs, which are generated from 5-digit hex values concatenated with a "Hitron" substrin...

Hitron CODA-4582 and CODA-4589 Security Vulnerabilities

The Hitron Technologies CODA-4582 and Hitron Technologies CODA-4589 are demodulator routers from Hitron Technologies, a Chinese company. A security vulnerability exists in the Hitron CODA-4582 and CODA-4589 that stems from the devices having default PSKs that are generated by concatenating a...

digit-eyes.com Cross Site Scripting vulnerability OBB-3852265

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-49949

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

CVE-2023-49949

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

CVE-2023-49949

Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes...

PT-2023-8120 · Passwork · Passwork

Name of the Vulnerable Software and Affected Versions: Passwork versions prior to 6.2.0 Description: The issue is related to weaknesses in the authorization procedure of Passwork, a corporate password manager. It allows a remote attacker to bypass two-factor authentication 2FA by brute-forcing a...

Authentication flaw

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

CVE-2023-3222

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values...

CVE-2023-3222 Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values...