Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Impact Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using...

Authentication flaw

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP reque...

CVE-2022-32769

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP reque...

CVE-2022-2822

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

CVE-2022-2822 Authentication Bypass by Primary Weakness in octoprint/octoprint

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts...

Cross-site Request Forgery (CSRF)

liferay is vulnerable to cross-site request forgery. The vulnerability exists due to the lack of validation in the csrf token in the process function of EditPageHandler.java, allowing an attacker to guess the csrf token value...

CVE-2022-34754

A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C A9XELC10-A V1.7.5 and prior, Acti9 PowerTag Link C A9XELC10-B V2.12.0 and prior...

CVE-2022-34754

A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C A9XELC10-A V1.7.5 and prior, Acti9 PowerTag Link C A9XELC10-B V2.12.0 and prior...

CVE-2022-34754

A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C A9XELC10-A V1.7.5 and prior, Acti9 PowerTag Link C A9XELC10-B V2.12.0 and prior...

CVE-2022-34754

A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C A9XELC10-A V1.7.5 and prior, Acti9 PowerTag Link C A9XELC10-B V2.12.0 and prior...

kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak

The Linux kernel's TCP source port generation algorithm in the TCP stack contains a flaw due to the small table perturb size. This flaw allows an attacker to positively distinguish a system among devices with identical hardware and software, which lasts until the device restarts. An attacker can...

CVE-2022-21935 Metasys password guessing

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change...

Johnson Controls Metasys ADS/ADX/OAS Servers 授权问题漏洞

Johnson Controls Metasys ADS/ADX/OAS Servers is an application and data server from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls Metasys ADS/ADX/OAS Servers versions 10 and 11, which stems from an unauthenticated password change, and can be exploited by an attacker t...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

Zyxel GS1200 安全漏洞

The Zyxel GS1200 is a series of switches from China-based Hopkins Technology Zyxel. A security vulnerability exists in the Zyxel GS1200 series of switches that stems from an improperly controlled interaction frequency vulnerability. A local attacker can exploit the vulnerability to guess password...

CVE-2022-30740

Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers...

PT-2022-3215 · Zyxel · Zyxel Gs1200

Name of the Vulnerable Software and Affected Versions: Zyxel GS1200 series switches affected versions not specified Description: The issue is related to an improper control of interaction frequency, which could allow a local attacker to guess the password by using a timing side-channel attack. Th...

GHSA-4225-97PR-RR52 OpenStack Keystone allows information disclosure during account locking

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...