Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
476 results · page 3 of 10
Oct 10, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.CVE-2025-9551 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comdocs.herodevs.com
Oct 6, 2025A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gatheCVE-2025-58591 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-58590 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure.CVE-2025-8679 · Other software · Extreme Networks · reported by 1c053176-eef3-4d6a-ae0b-24728c86587bHigh 7.6
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
- Product
- ExtremeGuest Essentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextreme-networks.my.site.com
Sep 30, 2025PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout.CVE-2025-8118 · Other software · Polska Akademia Dostępności · reported by cvd@cert.plMedium 6.9
PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
- Product
- PAD CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to bruCVE-2025-36064 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Sterling Connect:Express for Microsoft Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, BruteCVE-2025-1740 · Other software · Akinsoft · reported by iletisim@usom.gov.trCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.
- Product
- MyRezzta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 2, 2025Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.CVE-2025-55474 · Other software · Brufdev · reported by MITREMedium 6.1
Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.
- Product
- Many Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-ducky.comgithub.com
Aug 13, 2025Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.CVE-2025-52392 · Other software · reported by MITREMedium 5.4
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeafn28.gitbook.iogithub.com
Jul 28, 2025IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2024-49342 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Informix Dynamic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcinCVE-2025-6523 · Other software · Devolutions · reported by security@devolutions.netCritical 9.5
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 beforeCVE-2025-7393 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
- Product
- Mail Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local aCVE-2025-41459 · Other software · Two App Studio · reported by a341c0d1-ebf7-493f-a84e-38cf86618674High 7.8
Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection.
- Product
- Journey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.CVE-2024-9342 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Product
- Eclipse Glassfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Memory corruption while processing event close when client process terminates abruptly.CVE-2025-27050 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing event close when client process terminates abruptly.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookiesCVE-2025-48461 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 5
Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords.
- Product
- Advantech Wireless Sensing and Equipment (WISE)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute forceCVE-2025-2171 · Other software · Aviatrix · reported by mandiant-cve@google.comHigh 7.8
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud.google.comgithub.com
Jun 21, 2025Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).CVE-2025-52916 · Other software · Yealink · reported by MITRELow 2.2
Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).
- Product
- RPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.CVE-2025-28389 · Other software · Openc3 · reported by MITRECritical 9.8
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
- Product
- Cosmos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenc3.comvisionspace.com
Jun 12, 2025The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the CVE-2025-49195 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-CVE-2025-49186 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- Product
- Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modernCVE-2024-23589 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modern hardware such as GPUs or ASICs
- Product
- HCL Glovius Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 17, 2025RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbiCVE-2025-48187 · Other software · infiniflow · reported by MITRECritical 9.1
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.
- Product
- RAGFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force aCVE-2023-34732 · Other software · Flytxt · reported by MITREMedium 5.4
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords.
- Product
- Neon-dx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025An unauthenticated user could discover account credentials via a brute-force attack without rate limitingCVE-2025-46739 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 8.1
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
- Product
- SEL Blueframe OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.
- Product
- BruteGuard – Brute Force Login Protection
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2025An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.CVE-2024-53591 · Other software · Seclore · reported by MITRECritical 9.8
An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.
- Product
- Seclore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 befoCVE-2025-3129 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
- Product
- Access code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Bruno is an open source IDE for exploring and testing APIs.CVE-2025-30354 · Other software · usebruno · reported by GitHubHigh 8.7
Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno collection. The vulnerability is fixed in 1.39.1.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Bruno is an open source IDE for exploring and testing APIs.CVE-2025-30210 · Other software · usebruno · reported by GitHubHigh 8.7
Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate.CVE-2025-0417 · Other software · Valmet · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 7
Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.
- Product
- Valmet DNA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.CVE-2025-31676 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.8
Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
- Product
- Email TFA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack.CVE-2025-29311 · Other software · Opennetworking · reported by MITREHigh 7.5
Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse.CVE-2025-1496 · Other software · BG-TEK · reported by iletisim@usom.gov.trMedium 6.5
Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This issue affects Coslat Hotspot: before 6.26.0.R.20250227.
- Product
- Coslat Hotspot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trcoslat.com
Mar 18, 2025A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.CVE-2025-25595 · Other software · Iitb · reported by MITRECritical 9.8
A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.
- Product
- Safe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.complay.google.com
Mar 13, 2025WordPress Report Brute Force Attacks and Login Protection ReportAttacks: SQL InjectionCVE-2025-2250 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WordPress Report Brute Force Attacks and Login Protection ReportAttacks
- Affected
- up to 2.32
- What to do
- Affects up to 2.32. Update WordPress Report Brute Force Attacks and Login Protection ReportAttacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2025IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2024-51476 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification.CVE-2025-23085 · Other software · NodeJS · reported by support@hackerone.comMedium 5.3
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orglists.debian.org
Feb 6, 2025A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk CVE-2024-57610 · Other software · Sylius · reported by MITREHigh 7.5
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use "firewalls, rate-limiting middleware, or authentication providers" for that functionality.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an aCVE-2025-0693 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.9
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
- Product
- AWS Sign-in IAM Login Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSCVE-2024-13454 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.3
Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3
- Product
- Easy-RSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2024Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-CVE-2024-7701 · Other software · percona · reported by 96148269-fe82-4198-b1bf-3a73ce8bc92eMedium 5.1
Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0.
- Product
- percona-toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.CVE-2024-46442 · Other software · reported by MITRECritical 9.8
An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combydauto.com.cn
Nov 22, 2024WordPress Brute Force Protection – Stop Brute Force Attacks: Reflected Cross-Site ScriptingCVE-2024-10869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WordPress Brute Force Protection – Stop Brute Force Attacks
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2024phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-CVE-2024-0787 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.9
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is checked and used instead of 'REMOTE_ADDR'. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs.CVE-2024-47592 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
- Product
- SAP NetWeaver Application Server Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicatioCVE-2024-51190 · Other software · trendnet · reported by MITREMedium 4.8
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicationName_1.1.6.0.0 parameter on the /special_ap.htm page.
- Product
- tew-651br_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrendnet.com
Nov 11, 2024TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.CVE-2024-51189 · Other software · trendnet · reported by MITREMedium 4.8
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.1.0.0 parameter on the /filters.htm page.
- Product
- tew-651br_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrendnet.com
Nov 11, 2024TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualSerCVE-2024-51188 · Other software · trendnet · reported by MITREMedium 4.8
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0 parameter on the /virtual_server.htm page.
- Product
- tew-651br_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrendnet.com
Nov 11, 2024TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_NameCVE-2024-51187 · Other software · trendnet · reported by MITREMedium 4.8
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Name_1.1.1.0.0 parameter on the /firewall_setting.htm page.
- Product
- tew-651br_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrendnet.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.