Access Control Bypass

Overview docksible is a Deploy and set up Docker Compose based web apps with Ansible Affected versions of this package are vulnerable to Access Control Bypass. This vulnerability allows attackers to exploit the /xmlrpc.php endpoint in WordPress, enabling brute force attacks, DDoS attacks, and...

CVE-2024-52801

SFTPGo (CVE-2024-52801) is affected by an OpenID Connect cookie vulnerability in which authenticated users can brute-force session cookies due to predictably generated cookies via the xid library. The issue enables access to other users’ data and is addressed in version 2.6.4, where cookies are m...

PT-2024-41499 · 'Ред Софт' · Ред База Данных

Уязвимость функции force close модуля inet.cpp системы управления базами данных «Ред База Данных» связана с некорректной проверкой сериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Security Bulletin: Financial Transaction Manager v4 is impacted by multiple vulnerabilities in IBM Java SE

Summary Multiple vulnerabilities were addressed in Financial Transaction Manager v4.0.6.0 iFix4 Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality, high integrity...

CVE-2024-9928

A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports onl...

CVE-2024-9928

A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports onl...

CVE-2024-9928

The CVE-2024-9928 entry concerns the NSD570 login panel, where the authentication mechanism does not properly restrict excessive attempts, enabling potential account takeover or unauthorized access via brute-force against device login. The provided documents describe the affected component as the...

CVE-2024-9928

A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports onl...

PT-2024-39943 · Nsd570 · Nsd570

Name of the Vulnerable Software and Affected Versions: NSD570 affected versions not specified Description: A vulnerability exists in the login panel of NSD570 that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the...

The vulnerability of the microprogrammed software of the D-Link DSL6740C modem, related to the display of the WiFi password, allows a intruder to execute a brute-force attack.

The vulnerability of D-Link DSL6740C modem’s microprogramming software lies in the fact that the default Wi-Fi password is displayed during network scanning. Exploiting this vulnerability allows a remote attacker to execute a brute-force attack...

CVE-2024-10869

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

CVE-2024-10869 GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

CVE-2024-10869

CVE-2024-10869 : GuardGiant WordPress plugin “WordPress Brute Force Protection – Stop Brute Force Attacks” is vulnerable to Reflected Cross-Site Scripting due to improper escaping of add_query_arg/remove_query_arg in versions up to and including 2.2.6. Affected plugin: WordPress Brute Force Prote...

CVE-2024-10869 GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, the HTTPREDIRECTSTATUS variable was used to determine whether a CGI binary was being executed by the HTTP server. However, in certain scenarios, the content of this variable could be controlled by the reque...

Astra Linux – Vulnerability in freeipa

A vulnerability was discovered in FreeIPA when a Kerberos TGS-REQ is encrypted using the client’s session key. This key varies for each new session, which helps protect it from brute-force attacks. However, the tickets contained within are encrypted using the target principal key directly. For us...

WordPress plugin WordPress Brute Force Protection 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin WordPress Brute Force...

WordPress GuardGiant Brute Force Protection plugin <= 2.2.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin WordPress Brute Force Protection – Stop Brute Force Attacks versions = 2.2.6...

Security Bulletin: IBM SPSS Analytic Server has addressed multiple security vulnerabilities (CVE-2022-48285, CVE-2022-48285)

Summary IBM SPSS Analytic Server has addressed multiple security vulnerabilities CVE-2022-48285, CVE-2022-48285 Vulnerability Details CVEID:CVE-2022-48285 DESCRIPTION: JSZip could allow a remote attacker to traverse directories on the system, caused by the failure to sanitize filenames when files...

WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.6 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Brute Force Protection – Stop Brute Force Attacks Type Plugin Vulnerable versions = 2.2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10869 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership...