Vulnerabilities

TI-2021-15692 CVE-2021-37934 · GHSA-93p6-c827-87mm

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in…

MEDIUM 45

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0155 Published 2021-12-10 No fix listed CWE-307

TI-2021-15693 CVE-2021-37935 · GHSA-xv5r-jf97-8xjm

An information disclosure vulnerability in the login page of Huntflow Enterprise before…

LOW 36

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01415 Published 2021-12-10 No fix listed CWE-200

TI-2021-15691 CVE-2021-37933 · GHSA-cpvv-gp4v-6qh5

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6…

LOW 36

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01514 Published 2021-10-14 No fix listed CWE-74

Vulnerabilities

Filters

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in…

An information disclosure vulnerability in the login page of Huntflow Enterprise before…

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6…