POJIA破甲
地图 / Login page password-guessing attack

Login page password-guessing attack

身份认证 / 违反安全设计原则(按标题归类) / #96115

厂商
Revive Adserver
严重程度
未评级
赏金
—
弱点
违反安全设计原则(按标题归类)
研究员
@karan
披露日期
2024-04-19
资产
—
CVE
CVE-2016-9124

该报告还没有中文解读。

原文摘录

摘自原文(1331 字符中的一小部分)
Vulnerability description :- A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Revive Adserver 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @karan · 版权归作者与 Revive Adserver 所有

同类报告

Account Takeover at worki.ruMail.ru · — · $1,500Leak of authorization urls leads to account takeoverBumble · 2020-05-08Password not checked when disabling 2FA on HackerOneHackerOne · 2019-06-07Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeWakaTime · 2025-08-05ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNTMattermost · 2022-01-05OAuth2 "authorization_code" is valid indefinetlyNextcloud · 2024-02-17 · $100