CVE-2024-10511

CVE-2024-10511 CWE-287: Autenticazione impropria Sommario Il prodotto Schneider Electric PowerChute Serial Shutdown è un software di gestione UPS che consente lo spegnimento ordinato del sistema e funzionalità di gestione dell'energia per desktop, server e workstation. PowerChute Serial Shutdown...

CVE-2026-82269

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

POC-CVE-2022-30600

Proof of concept per CVE-2022-30600 Panoramica Questo repository contiene 2 implementazioni per un proof of concept che sfrutta CVE-2022-30600. CVE-2022-30600 è una vulnerabilità di sicurezza che consente a un attaccante di bypassare la soglia di blocco dell'account all'interno del webapp moodle...

CVE-2026-82269

Gophish through 0.12.1 has a flaw in its API authentication middleware that fails to enforce account lockout and forced password change policies when a user authenticates with a valid API key. An attacker who already holds a valid API key can retain full API access even after the associated accou...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

EUVD-2026-67800

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC della recente vulnerabilità di brute force sulle password di Azure Active Directory scoperta da SecureWorks Descrizione Questo codice è una proof-of-concept della recentemente rivelata vulnerabilità di brute force sulle password di Azure Active Directory annunciata da...

Spray365

Cos'è Spray365? Spray365 è uno strumento di password spraying che identifica credenziali valide per account Microsoft Office 365 / Azure AD. In cosa Spray365 è diverso dai molti altri strumenti di password spraying già disponibili? Spray365 consente di effettuare password spraying basandosi su un...

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

EUVD-2026-67285

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

CVE-2026-54085

Wazuh (open-source XDR/SIEM platform), versions 4.2.0 through 4.14.6 , contains missing input validation in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands running as root. Five scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c ) omit th...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

CVE-2026-76940 affects the Ebyte NE2-D11 device, which does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This lack of control allows an attacker to perform automated password-based authentication attacks against deployments relying on such aut...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

buffalo

Buffalo Uno script Python 3 per eseguire attacchi dizionario/wordlist su un server SSH target utilizzando due file di testo come input. Scritto ai fini del mio technical screening Intel. Installazione Questo script dipende da Paramiko e Colorama. Installa le dipendenze tramite pip install -r...

FaceBrute

FaceBrute Script per forza bruta di Facebook Questo script tenta di indovinare le password per un dato account Facebook utilizzando un elenco di password dizionario. Poiché Facebook blocca temporaneamente l'accesso agli account che falliscono continuamente il login, questo script è codificato in...