Design/Logic Flaw

A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout...

CVE-2019-18917

CVE-2019-18917 affects certain HP Printers and All-in-One devices, where the underlying issue allows bypassing account lockout. The vulnerability is documented across multiple feeds, with HP’s own advisory (HP C06594863) confirming a potential account lockout bypass and noting that software updat...

CVE-2019-18917

A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout...

HPSBPI03660 rev. 1 - HP Inkjet Printers Account Lockout Issue

Potential Security Impact Account lockout bypass Source: HP, HP Product Security Response Team PSRT Reported by: Alexander Drabek, Logically Secure Limited VULNERABILITY SUMMARY A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassi...

CVE-2019-14299

Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force...

CVE-2019-13166

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks...

CVE-2019-13166

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks...

CVE-2019-13166

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks...

Design/Logic Flaw

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks...

CVE-2019-13166

CVE-2019-13166 affects Xerox printers (example: Phaser 3320 with V53.006.16.000). The root issue is lack of account lockout, enabling brute-force attempts to extract local credentials from the device. Public sources in connected documents confirm this vulnerability scenario and affected class, bu...

CVE-2019-13166

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks...

Monero: Monero wallet password change is confirmed when not matching

Summary: If you change your wallet password in gui, the confirmation does not need to match the new password. Releases Affected: list each version and OS of the application affected list each version and OS of the application affected Steps To Reproduce: Open your wallet. Go to settings. Change...

Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...

Linux: Lockout time for locked accounts

The lockout time for locked accounts can be set in two modules: - pamtally2: The login counter tallying module - pamfaillock: Module counting authentication failures during a specified interval Use the unlocktime=n option to re-enable login after n seconds after the lock out. Copyright C 2020...

Insecure Authentication Controls

dolibarr/dolibarr is vulnerable to brute-force attacks. Lack of account lockout mechanism allows a remote attacker to attempt a brute-force attack on the log-in module to discover user credentials...

CVE-2018-16857

It was found that the 'bad password observation window' was ineffective when set to a value greater than 3 minutes. This could allow for brute force password attacks in some situations. Mitigation Bad password lockout is not configured by default, it is only effective if a threshold has been set...

Linux: Lockout for failed authentication attempts

The lockout for failed password attempts can be set in two modules: - pamtally2: The login counter tallying module - pamfaillock: Module counting authentication failures during a specified interval Use the deny=n option to deny access if the number of consecutive authentication failures for this...

EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2019-2369)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different retu...

Stripo Inc: Improper Authorization

hi there , i found an vulnerability on https://my.stripo.email/cabinet//users/orogid , generally every user have an organisation and the organisation contain projects , lets suppose : [email protected] is the owner of the project and [email protected] was invited to his project as admin , in normal...

Unspecified Vulnerability in IBM Cloud Pak System

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A security vulnerability exists in IBM Cloud Pak System version V2.3.0, which...