Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
593 results · page 6 of 12
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
- Product
- WPS Hide Login
- Affected
- up to 1.5.4.2
- What to do
- Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
May 31, 2023In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacksCVE-2023-34227 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.CVE-2022-47138 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2023 Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service.CVE-2023-32350 · Other software · Teltonika · reported by ics-cert@hq.dhs.govHigh 8
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
- Product
- RUT model routers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters.CVE-2023-32349 · Other software · Teltonika · reported by ics-cert@hq.dhs.govHigh 8
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
- Product
- RUT model routers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentiCVE-2023-1385 · Other software · Amazon · reported by cve-requests@bitdefender.comHigh 7.1
Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3.
- Product
- Fire TV Stick 3rd gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Apr 18, 2023 A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is peCVE-2022-43377 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)
- Product
- NetBotz 4 - 355/450/455/550/570
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Apr 15, 2023ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000.CVE-2022-30076 · Other software · Entab · reported by MITREMedium 5.3
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 14, 2023The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks.CVE-2023-26756 · Other software · Revive · reported by MITREHigh 7.5
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.
- Product
- Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggoogleinformationsworld.blogspot.com
Apr 13, 2023BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 hCVE-2023-27746 · Other software · Blackvue · reported by MITRECritical 9.8
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
- Product
- Dr750-2ch LTE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblackvue.comgithub.com
Apr 10, 2023Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials.CVE-2023-29005 · Other software · dpgaspar · reported by GitHubHigh 7.5
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflask-limiter.readthedocs.iogithub.com
Mar 23, 2023Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.CVE-2022-36413 · Email & office · Zohocorp · reported by MITRECritical 9.1
Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Feb 21, 2023A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce CVE-2023-24080 · Other software · Chamberlain · reported by MITRECritical 9.8
A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack.
- Product
- MYQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgarchive.ph
Feb 21, 2023Nautobot is a Network Source of Truth and Network Automation Platform.CVE-2023-25657 · Other software · nautobot · reported by GitHubHigh 7.5
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has enabled sandboxed environments for the Jinja2 template engine used internally for template rendering for the following objects: `extras.ComputedField`, `extras.CustomLink`, `extras.ExportTemplate`, `extras.Secret`, `extras.Webhook`. While no active exploits of this vulnerability are known this change has been made as a preventative measure to protect against any potential remote code execution attacks utilizing maliciously crafted template code. This change forces the Jinja2 template engine to use a `SandboxedEnvironment` on all new installations of Nautobot. This addresses any potential unsafe code execution everywhere the helper function `nautobot.utilities.utils.render_jinja2` is called. Additionally, the documentation that had previously suggesting the direct use of `jinja2.Template` has been revised to suggest `render_jinja2`. Users are advised to upgrade to Nautobot 1.5.7 or newer. For users that are unable to upgrade to
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account whCVE-2022-32515 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox (All Versions)
- Product
- Conext™ ComBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 30, 2023A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the passworCVE-2022-32513 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)
- Product
- C-Bus Network Automation Controller, LSS5500NAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 30, 2023 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.CVE-2023-24020 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 7.5
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login.
- Product
- Wattbox WB-300-IP-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.CVE-2022-48067 · Other software · Totolink · reported by MITREMedium 5.5
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbefitting-vinca-933.notion.sitebefitting-vinca-933.notion.site
Jan 23, 2023BruteBank: Does not have CSRF check in placeCVE-2022-4443 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- BruteBank
- Fixed in
- 1.9
- What to do
- Update BruteBank to 1.9 or newer.
Jan 20, 2023HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.CVE-2021-27782 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
- Product
- BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 26, 2022Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack.CVE-2022-26964 · Other software · Devolutions · reported by MITREHigh 7.4
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Dec 8, 2022Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.CVE-2022-44938 · Other software · Seeddms · reported by MITRECritical 9.8
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute forCVE-2022-45482 · Other software · thisAAY · reported by disclosure@synopsys.comCritical 9.8
Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Product
- Lazy Mouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Nov 25, 2022Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforCVE-2022-44411 · Other software · Web Based Quiz System Project · reported by MITREHigh 7.5
Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforce attack.
- Product
- Web Based Quiz System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022User login brute force protection functionality bypass CVE-2022-27516 · Network & remote access · Citrix · reported by secure@citrix.comMedium 5.3
User login brute force protection functionality bypass
- Product
- Citrix Gateway, Citrix ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Oct 17, 2022An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.CVE-2022-40055 · Other software · Gxgroup · reported by MITRECritical 9.8
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
- Product
- Gpon ONT Titanium 2122a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.alphathreat.inblog.alphathreat.in
Oct 17, 2022Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords.CVE-2022-2052 · Other software · TRUMPF Werkzeugmaschinen SE + Co. KG · reported by info@cert.vde.comCritical 9.8
Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.
- Product
- TruTops Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Oct 12, 2022Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability.CVE-2022-31228 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.
- Product
- XtremIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account TCVE-2022-33106 · Other software · Wijungle · reported by MITRECritical 9.8
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
- Product
- U250 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhexisanoob.gitbook.iohexisanoob.gitbook.io
Sep 28, 2022ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limitinCVE-2022-36781 · Other software · ConnectWise · reported by cna@cyber.gov.ilMedium 5.3
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.
- Product
- ScreenConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files wCVE-2022-36871 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
- Product
- Samsung Pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 8, 2022Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.CVE-2022-37164 · Other software · Ontrack Project · reported by MITRECritical 9.8
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
- Product
- Ontrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgcwe.mitre.org
Sep 8, 2022Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force atCVE-2022-37163 · Other software · Ihatetobudget Project · reported by MITRECritical 9.8
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
- Product
- Ihatetobudget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack.CVE-2022-36555 · Other software · Hytec · reported by MITRECritical 9.8
Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack.
- Product
- Hwl-2511-ss Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comhytec.co.jp
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.21.83
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Aug 29, 2022The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's migCVE-2022-3019 · Other software · tooljet · reported by security@huntr.devHigh 8.8
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
- Product
- tooljet/tooljet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.CVE-2021-3513 · Other software · Redhat · reported by Red HatHigh 7.5
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 19, 2022Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.CVE-2022-34615 · Other software · Mealie · reported by MITRECritical 9.8
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgdocs.mealie.io
Aug 17, 2022The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update.CVE-2022-23764 · Other software · TERUTEN Co.,Ltd · reported by vuln@krcert.or.krHigh 8.8
The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.
- Product
- WebCube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Aug 15, 2022An attacker can freely brute force username and password and can takeover any account.CVE-2022-2822 · Other software · octoprint · reported by security@huntr.devHigh 7.5
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the applicatiCVE-2022-2457 · Other software · Redhat · reported by Red HatCritical 9.8
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
- Product
- Process Automation Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 4, 2022Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.CVE-2022-35143 · Other software · Raneto Project · reported by MITRECritical 9.8
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
- Product
- Raneto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraneto.comcwe.mitre.org
Aug 1, 2022BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password.CVE-2022-36301 · Other software · Bosch · reported by psirt@bosch.comCritical 9.8
BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password.
- Product
- BF-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jul 28, 2022An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.CVE-2021-22640 · Other software · Ovarro · reported by ics-cert@hq.dhs.govHigh 7.5
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
- Product
- TBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-foCVE-2021-23451 · Other software · Otp-generator Project · reported by report@snyk.ioMedium 6.5
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
- Product
- Otp-generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2022-22452 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918.
- Product
- Security Verify Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 30, 2022An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agentCVE-2022-22487 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
- Product
- Spectrum Protect Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 14, 2022An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.CVE-2022-31273 · Other software · 17ido · reported by MITRECritical 9.8
An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.
- Product
- Topidp3000 Topsec Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forceCVE-2022-30235 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- Product
- Wiser Smart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication.CVE-2022-1300 · Other software · TRUMPF · reported by info@cert.vde.comCritical 9.8
Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service.
- Product
- TruTops Boost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.