CVE-2021-37933

The CVE-2021-37933 entry pertains to Huntflow Enterprise; an LDAP injection in /account/login could let an unauthenticated remote attacker bypass authentication by manipulating the email parameter used to build LDAP queries. Affected versions are prior to 3.10.6. Root cause: insufficient server-s...

CVE-2021-37934

Huntflow Enterprise before 3.10.14 is affected by CVE-2021-37934 due to insufficient server-side login attempt limits on /account/login, allowing an unauthenticated remote user to perform multiple login attempts for brute-force password guessing. This vulnerability is documented across multiple s...

CVE-2021-37935

CVE-2021-37935 affects Huntflow Enterprise prior to 3.10.4. The flaw resides on the login page and allows an unauthenticated remote attacker to discover the domain name of the configured LDAP server by requesting the login page and inspecting the HTML for the isLdap parameter. Impact is noted as ...