EulerOS Virtualization 2.10.1 : bind (EulerOS-SA-2023-2911)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it h...

EulerOS 2.0 SP10 : bind (EulerOS-SA-2023-2802)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sen...

PT-2024-1155 · Oracle · Oracle Audit Vault/Database Firewall

Name of the Vulnerable Software and Affected Versions: Oracle Audit Vault and Database Firewall versions 20.1 through 20.9 Description: The issue is related to insufficient input validation in the Firewall component of Oracle Audit Vault and Database Firewall, allowing a remote attacker to gain...

EulerOS 2.0 SP10 : dhcp (EulerOS-SA-2023-3204)

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent...

PT-2024-1461 · Tenda · Tenda W9

Name of the Vulnerable Software and Affected Versions: Tenda W9 version 1.0.0.74456 Description: The issue is related to a critical vulnerability in the setWrlBasicInfo function of the httpd component. This vulnerability allows for a stack-based buffer overflow due to the manipulation of the...

GHSA-CHCR-X7HC-8FP8 Devise-Two-Factor vulnerable to brute force attacks

Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...

Devise-Two-Factor vulnerable to brute force attacks

Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...

Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...

CVE-2023-6934

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-6934 Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PHPJabbers Hotel Booking System Security Vulnerability

Hotel Booking System is a hotel booking system. A security vulnerability exists in PHPJabbers Hotel Booking System version 4.0, which stems from the presence of a lost rate limit vulnerability...

PHPJabbers Shared Asset Booking System Security Vulnerability

PHPJabbers Shared Asset Booking System is a shared asset booking system from PHPJabbers Serbia. A security vulnerability exists in PHPJabbers Shared Asset Booking System version 1.0, which stems from the presence of a lost rate limit vulnerability...

PHPJabbers Cinema Booking System Security Vulnerability

PHPJabbers Cinema Booking System is a theater booking system from PHPJabbers. A security vulnerability exists in PHPJabbers Cinema Booking System version 1.0, which stems from a lost rate limit vulnerability...

PHPJabbers Meeting Room Booking System Security Vulnerability

PHPJabbers Meeting Room Booking System is a meeting room booking system from the Serbian company PHPJabbers. A security vulnerability exists in PHPJabbers Meeting Room Booking System version 1.0, which originates from a lost rate limit vulnerability...

PHPJabbers Shared Asset Booking System 1.0 Missing Rate Limit

Exploit Title: PHPJabbers Shared Asset Booking System v1.0 - No Rate Limit Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/shared-asset-booking-system/sectionDemo Version: v1.0 Test...

PHPJabbers Hotel Booking System 4.0 Missing Rate Limiting

Exploit Title: PHPJabbers Hotel Booking System v4.0 - No Rate Limit Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/hotel-booking-system/sectionDemo Version: v4.0 Tested on: Windows...

WordPress Plugin Limit Login Attempts Reloaded Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PHPJabbers Car Park Booking System Security Vulnerability

PHPJabbers Car Park Booking System is a parking lot booking system by PHPJabbers. A security vulnerability exists in PHPJabbers Car Park Booking System version 3.0, which stems from the presence of multiple lost rate limit vulnerabilities...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

PHPJabbers Car Park Booking System Security Vulnerability

PHPJabbers Car Park Booking System is a parking lot booking system by PHPJabbers. A security vulnerability exists in PHPJabbers Car Park Booking System version 3.0, which stems from the presence of multiple lost rate limit vulnerabilities...