152 matches found
ad-password-protection
Lithnet Password Protection for Active Directory LPP は、すべての Active Directory アカウントに強力なパスワードを確保したいと考える組織が利用できる選択肢を拡張します。 LPP は Active Directory サーバーにインストールするモジュールで、パスワードフィルターを使用して、ユーザーがパスワードを変更しようとする際にパスワードを検査します。グループポリシーを使用して、それらのパスワードに対して実行するチェックの種類をカスタマイズし、パスワードは拒否されるか、承認されてディレクトリにコミットされます。 LPP...
CVE-2024-42850
CVE-2024-42850 Silverpeas v6.4.2 及更低版本的密码更改功能中存在一个问题，允许绕过密码复杂度要求。 分析 更改密码时，在提交新密码后，密码首先会通过 POST 请求发送到一个端点，该端点会检查密码是否符合复杂度要求。 在 Silverpeas 确认密码符合要求后，会发出另一个 POST 请求来更新账户，且该请求不再对密码进行任何检查，因此可以设置单个字符的密码。...
EUVD-2026-87956
The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...
CVE-2026-101041
The vulnerability-lookup web application contains a TOCTOU race condition in its account recovery functionality (/user/confirm_account/). Specifically, the logic in the User model (website/models/user.py) and view layer (website/web/views/user.py) verifies and consumes single-use recovery tokens ...
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
SummaryThe user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the...
PYSEC-2026-1349 Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
Summary The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the...
PYSEC-2026-370 Openstack Keystone Incorrect Authorization vulnerability
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...
CVE-2026-6284
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
EUVD-2026-23442
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2026-6284
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2026-6284 Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible...
CVE-2021-22003
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
PT-2025-43670
Name of the Vulnerable Software and Affected Versions Microweber CMS version 2.0 Description The application does not enforce minimum password length or complexity during password resets. This allows users to set weak passwords, including single-character passwords, potentially leading to account...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
CVE-2025-60954
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts...
EUVD-2019-5959
Malware in sbrugna...
EUVD-2025-18666
Malicious code in bioql PyPI...