CVE-2023-26271

IBM Guardium Data Encryption (GCKM) 1.10.3 and earlier is affected by CVE-2023-26271 due to an inadequate account lockout that could allow remote brute-forcing of credentials. The issue affects Guardium Cloud Key Manager (GCKM) within IBM Guardium Data Encryption; root cause described as improper...

PT-2023-20580 · Ibm · Ibm Security Guardium Data Encryption

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Data Encryption version 1.10.3 Description: The issue is related to an inadequate account lockout setting in IBM Security Guardium Data Encryption, which could allow a remote attacker to brute force account credentials...

KNX Connection Authorization 安全漏洞

KNX Connection Authorization is a network security product from KNX Open Source. KNX Connection Authorization suffers from a security vulnerability that stems from the fact that it is easy to be locked out and that users cannot reset them to gain access to the device...

KNX Protocol

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity/known public exploitation Vendor: KNX Association Equipment: KNX devices using KNX Connection Authorization Vulnerability: Overly Restrictive Account Lockout Mechanism 2. RISK EVALUATION Successful exploitation...

Business Logic Errors

github.com/answerdev/answer is vulnerable to Business Logic Errors. The vulnerability exists in UpdateUserPassword function at userbackyard.go because the password restrictions are not properly set which allows an attacker to lock victims out of their account...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

Moxa EDS-G516E and EDS-510E Series Ethernet Switches Weak Password Requirements (CVE-2020-6991)

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

GHSA-C7XW-P58W-H6FJ Keycloak: Impersonation and lockout possible through incorrect handling of email trust

Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them...

Keycloak: Impersonation and lockout possible through incorrect handling of email trust

Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method

A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on...

Authentication Bypass

.NET is vulnerable to Authentication Bypass. The vulnerability exists because the library does not immediately update the account lockout maximum failed attempts, allowing an attacker to brute force more passwords...

Ubuntu: Security Advisory (USN-6217-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

.NET Core Multiple Vulnerabilities (KB5028705, KB5028706) - Windows

.NET Core prone to security feature bypass and elevation of privilege vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Updates for Microsoft ASP.NET Core (July 2023)

Multiple vulnerabilities exist in ASP.NET Core 6.0 6.0.20 and ASP.NET Core 7.0 7.0.9. - A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve cross-session/cross-user elevation of privilege EoP and code execution. CVE-2023-33127 - A vulnerability exis...

GHSA-25C8-P796-JG6R Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and above. This advisory also provides guidance on what developers can do to upda...