Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
476 results · page 4 of 10
Nov 5, 2024The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypassCVE-2023-29126 · Other software · Enel X · reported by cve@asrg.ioMedium 4.2
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 4, 2024Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.CVE-2024-48463 · Other software · usebruno · reported by MITREMedium 6.5
Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 30, 2024D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforceCVE-2024-48272 · Other software · dlink · reported by MITREMedium 6.5
D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.
- Product
- dsl6740c_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdlink.com
Oct 17, 2024Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack.CVE-2023-6728 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Low 3.3
Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content.
- Product
- SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7705 SAR OS, 7210 SAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in CVE-2024-45272 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Oct 9, 2024The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugCVE-2024-48942 · Other software · syracom · reported by MITREMedium 5.9
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid.
- Product
- secure_login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyracom-bee.atlassian.net
Oct 9, 2024In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.CVE-2024-7293 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.5
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.CVE-2024-8643 · Other software · Oceanic Software · reported by iletisim@usom.gov.trCritical 9.3
Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0.
- Product
- ValeApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 28, 2024A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login.CVE-2021-22530 · Other software · OpenText · reported by security@opentext.comHigh 8.2
A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1
- Product
- NetIQ Advance Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.CVE-2024-43042 · Other software · Pluck-cms · reported by MITRECritical 9.8
Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.
- Product
- Pluck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 1, 2024Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approCVE-2024-23600 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comLow 2.7
Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure.
- Product
- PingIDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Jun 28, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration.CVE-2024-38322 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 28, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute foCVE-2024-25031 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 10, 2024Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of secoCVE-2024-28833 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.9
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comcheckmk.com
May 14, 2024KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisCVE-2024-3461 · Other software · Kioware · reported by cvd@cert.plMedium 6.2
KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number.
- Product
- Kioware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Affected
- up to 4.21.96
- What to do
- Affects up to 4.21.96. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 21, 2024This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute foCVE-2024-2464 · Other software · CDeX PSA · reported by cvd@cert.plMedium 6.3
This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.
- Product
- CDeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2024Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash.CVE-2022-47036 · Other software · siklu · reported by MITRECritical 9.8
Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware, which would typically be used with firmware 2.1.1 or later.
- Product
- tg_terragraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemaja2.netsemaja2.net
Mar 15, 2024The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.CVE-2023-7006 · Other software · Sciener · reported by cret@cert.orgCritical 9.1
The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.
- Product
- Kontrol Lux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
Feb 26, 2024Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack giveCVE-2024-0436 · Other software · mintplex-labs · reported by security@huntr.devMedium 5.9
Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2024An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.CVE-2024-1104 · Other software · Areal Topkapi · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.
- Product
- Webserv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordareal-topkapi.comareal-topkapi.com
Feb 16, 2024Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability.CVE-2024-22425 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.
- Product
- RecoverPoint for VMs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credCVE-2023-45191 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 268755.
- Product
- Engineering Lifecycle Optimization - Publishing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 2, 2024IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentiCVE-2023-38273 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733.
- Product
- Cloud Pak System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2023-50326 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 275107.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 25, 2024SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force CVE-2023-33759 · Other software · Splicecom · reported by MITRECritical 9.8
SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force attack.
- Product
- Maximiser Soft PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
- Product
- Solid Security – Password, Two Factor Authentication, and Brute Force Protection
- Affected
- up to 8.1.4
- What to do
- Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES MaCVE-2023-46648 · Other software · GitHub · reported by product-cna@github.comHigh 8.3
An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 20, 2023Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromiCVE-2023-6912 · Other software · M-Files Corporation · reported by security@m-files.comHigh 7.5
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Dec 19, 2023WordPress Brute Force Protection – Stop Brute Force Attacks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks: from n/a through 2.2.5.
- Product
- WordPress Brute Force Protection – Stop Brute Force Attacks
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 9, 2023A vulnerability classified as problematic has been found in linkding 1.23.0.CVE-2023-6646 · Other software · Sissbruecker · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.23.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-247338 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early, responded in a very professional manner and immediately released a fixed version of the affected product.
- Product
- Linkding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtreasure-blarney-085.notion.site
Dec 4, 2023A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks.CVE-2023-24051 · Other software · connectize · reported by MITRECritical 9.8
A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks.
- Product
- ac21000_g6_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.comresearch.nccgroup.com
Nov 30, 2023An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tCVE-2023-31176 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.5
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details.
- Product
- SEL-451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordselinc.comnozominetworks.com
Nov 13, 2023The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids.CVE-2023-42480 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.
- Product
- NetWeaver AS Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.CVE-2023-47102 · Other software · urbackup · reported by MITREMedium 5.3
UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.
- Product
- urbackup_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnitipoom-jaroonchaipipat.github.ioquantiano.github.io
Oct 31, 2023A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.CVE-2023-37832 · Other software · elenos · reported by MITREHigh 7.5
A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.
- Product
- etg150_fm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023 Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session beiCVE-2023-0897 · Other software · Sielco · reported by ics-cert@hq.dhs.govHigh 8.8
Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass autheCVE-2023-42769 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
- Product
- Analog FM transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.CVE-2023-37635 · Other software · Uvdesk · reported by MITRECritical 9.8
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
- Product
- Community-skeleton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Oct 23, 2023DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.CVE-2023-27152 · Other software · Opnsense · reported by MITRECritical 9.8
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.
- Product
- Opnsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Oct 11, 2023Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-44111 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 11, 2023 Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-44096 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 19, 2023Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attCVE-2023-4096 · Other software · Fujitsu · reported by cve-coordination@incibe.esHigh 8.6
Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023WP Brutal AI: Does not sanitise and escape some of its settingsCVE-2023-2606 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Brutal AI
- Fixed in
- 2.06
- What to do
- Update WP Brutal AI to 2.06 or newer.
Aug 10, 2023Uncontrolled search path element in some Intel(R) VCUST Tool software downloaded before February 3nd 2023 may allow an authenticated user to potentially enable CVE-2023-25944 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in some Intel(R) VCUST Tool software downloaded before February 3nd 2023 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vcust Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password wiCVE-2023-3669 · Other software · CODESYS · reported by info@cert.vde.comLow 3.3
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
- Product
- CODESYS Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jul 25, 2023An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.CVE-2023-3548 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.3
An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.
- Product
- IQ Wifi 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error messageCVE-2023-32657 · Other software · Weintek · reported by ics-cert@hq.dhs.govMedium 5.3
Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.CVE-2023-35697 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
- Product
- ICR890-4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the passwCVE-2023-34995 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 7.5
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.