CVE-2021-37934

Huntflow Enterprise before 3.10.14 is affected by CVE-2021-37934 due to insufficient server-side login attempt limits on /account/login, allowing an unauthenticated remote user to perform multiple login attempts for brute-force password guessing. This vulnerability is documented across multiple s...

CVE-2021-37933

The CVE-2021-37933 entry pertains to Huntflow Enterprise; an LDAP injection in /account/login could let an unauthenticated remote attacker bypass authentication by manipulating the email parameter used to build LDAP queries. Affected versions are prior to 3.10.6. Root cause: insufficient server-s...