152 matches found
ad-password-protection
Lithnet Password Protection for Active Directory LPP 为希望确保其所有 Active Directory 账户都拥有强密码的组织提供了更多选择。 LPP 是一个安装在 Active Directory 服务器上的模块，它使用密码筛选器在用户尝试更改密码时检查密码。通过组策略，您可以自定义要对这些密码执行的检查类型，密码要么被拒绝，要么被批准并提交到目录。 LPP 让您能够掌控什么才算是好密码。无论您是想部分还是完全采用 2018 年 NIST 密码建议，它都提供了一套丰富的基于组策略的控制措施，允许您对尝试的密码更改启用以下任意组合的检...
CVE-2024-42850
CVE-2024-42850 Silverpeas v6.4.2 及更低版本的密码更改功能中存在一个问题，允许绕过密码复杂度要求。 分析 更改密码时，在提交新密码后，密码首先会通过 POST 请求发送到一个端点，该端点会检查密码是否符合复杂度要求。 在 Silverpeas 确认密码符合要求后，会发出另一个 POST 请求来更新账户，且该请求不再对密码进行任何检查，因此可以设置单个字符的密码。...
EUVD-2026-87956
The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...
CVE-2026-101041
The vulnerability-lookup web application contains a TOCTOU race condition in its account recovery functionality (/user/confirm_account/). Specifically, the logic in the User model (website/models/user.py) and view layer (website/web/views/user.py) verifies and consumes single-use recovery tokens ...
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
SummaryThe user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the...
PYSEC-2026-1349 Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
Summary The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the...
PYSEC-2026-370 Openstack Keystone Incorrect Authorization vulnerability
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...
CVE-2026-6284
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
EUVD-2026-23442
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2026-6284
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2026-6284 Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2021-22003
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
PT-2025-43670
Name of the Vulnerable Software and Affected Versions Microweber CMS version 2.0 Description The application does not enforce minimum password length or complexity during password resets. This allows users to set weak passwords, including single-character passwords, potentially leading to account...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
EUVD-2019-5959
Malware in sbrugna...
EUVD-2025-18666
Malicious code in bioql PyPI...