{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1110 Brute Force","home_page_url":"https://patchfirst.co/technique/T1110/","feed_url":"https://patchfirst.co/feed/technique/T1110.json","description":"New and newly exploited CVEs that lead to ATT&CK T1110 Brute Force, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2020-0688#kev","url":"https://patchfirst.co/cve/CVE-2020-0688/","title":"[KEV] CVE-2020-0688: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1110 Brute Force; T1114 Email Collection; T1505.003 Web Shell. Named in 3 threat reports. Priority 86.9 of 100.","summary":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:46:21.000Z","tags":["kev","ransomware","public-exploit","T1190","T1110","T1114","T1505.003"],"_patchfirst":{"reason":"kev","priority":86.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99955,"percentile":0.99974},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1190","T1110","T1114","T1505.003"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-1472#kev","url":"https://patchfirst.co/cve/CVE-2020-1472/","title":"[KEV] CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability","content_text":"Microsoft · Netlogon. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1110 Brute Force; T1133 External Remote Services; T1021 Remote Services; T1068 Exploitation for Privilege Escalation; T1087.002 Domain Account; T1486 Data Encrypted for Impact. Named in 8 threat reports. Priority 86.8 of 100.","summary":"Microsoft Netlogon Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:01:29.000Z","tags":["kev","ransomware","public-exploit","T1110","T1133","T1021","T1068","T1087.002","T1486"],"_patchfirst":{"reason":"kev","priority":86.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99389,"percentile":0.9994},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Netlogon","techniqueIds":["T1110","T1133","T1021","T1068","T1087.002","T1486"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15093","url":"https://patchfirst.co/cve/CVE-2020-15093/","title":"CVE-2020-15093: Improper verification of signature threshold in tough","content_text":"awslabs · tough. Not in CISA KEV. EPSS 1.4% (higher than 71.6% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 20.3 of 100.","summary":"Improper verification of signature threshold in tough","date_published":"2020-07-09T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":20.3,"kev":null,"epss":{"score":0.01357,"percentile":0.71634},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"awslabs","product":"tough","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5365","url":"https://patchfirst.co/cve/CVE-2020-5365/","title":"CVE-2020-5365: Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability","content_text":"Dell · Isilon OneFS. Not in CISA KEV. EPSS 1.0% (higher than 62.3% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1110 Brute Force; T1078.001 Default Accounts. Priority 16.2 of 100.","summary":"Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability","date_published":"2020-05-20T00:00:00.000Z","date_modified":"2024-09-16T17:17:39.000Z","tags":["T1110","T1078.001"],"_patchfirst":{"reason":"published","priority":16.2,"kev":null,"epss":{"score":0.00985,"percentile":0.62343},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Dell","product":"Isilon OneFS","techniqueIds":["T1110","T1078.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-11035","url":"https://patchfirst.co/cve/CVE-2020-11035/","title":"CVE-2020-11035: weak CSRF tokens in GLPI","content_text":"glpi-project · GLPI. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 17.2 of 100.","summary":"weak CSRF tokens in GLPI","date_published":"2020-05-05T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.00898,"percentile":0.59574},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"glpi-project","product":"GLPI","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-18263","url":"https://patchfirst.co/cve/CVE-2019-18263/","title":"CVE-2019-18263: An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with…","content_text":"Not in CISA KEV. EPSS 0.2% (higher than 9.2% of CVEs). ATT&CK: T1110 Brute Force. Priority 1.8 of 100.","summary":"An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with…","date_published":"2019-12-20T00:00:00.000Z","date_modified":"2024-08-05T01:47:14.000Z","tags":["T1110"],"_patchfirst":{"reason":"published","priority":1.8,"kev":null,"epss":{"score":0.00195,"percentile":0.09212},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1110"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-16782","url":"https://patchfirst.co/cve/CVE-2019-16782/","title":"CVE-2019-16782: Possible Information Leak / Session Hijack Vulnerability in Rack","content_text":"rack · rack. Not in CISA KEV. EPSS 3.7% (higher than 89.7% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1110 Brute Force; T1563 Remote Service Session Hijacking. Priority 22.4 of 100.","summary":"Possible Information Leak / Session Hijack Vulnerability in Rack","date_published":"2019-12-18T00:00:00.000Z","date_modified":"2024-08-05T01:24:48.000Z","tags":["T1110","T1563"],"_patchfirst":{"reason":"published","priority":22.4,"kev":null,"epss":{"score":0.03703,"percentile":0.89728},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"rack","product":"rack","techniqueIds":["T1110","T1563"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1715","url":"https://patchfirst.co/cve/CVE-2019-1715/","title":"CVE-2019-1715: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability","content_text":"Cisco · Cisco Adaptive Security Appliance (ASA) Software. Not in CISA KEV. EPSS 1.7% (higher than 77.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1110 Brute Force; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle. Priority 19.2 of 100.","summary":"Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability","date_published":"2019-05-03T00:00:00.000Z","date_modified":"2024-11-19T19:08:18.000Z","tags":["T1110","T1040","T1078","T1557"],"_patchfirst":{"reason":"published","priority":19.2,"kev":null,"epss":{"score":0.01726,"percentile":0.77525},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Adaptive Security Appliance (ASA) Software","techniqueIds":["T1110","T1040","T1078","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-6563","url":"https://patchfirst.co/cve/CVE-2019-6563/","title":"CVE-2019-6563: Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the…","content_text":"ICS-CERT · Moxa IKS, EDS. Not in CISA KEV. EPSS 1.7% (higher than 77.8% of CVEs). ATT&CK: T1110 Brute Force; T1539 Steal Web Session Cookie; T1078 Valid Accounts. Priority 15.6 of 100.","summary":"Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the…","date_published":"2019-03-05T00:00:00.000Z","date_modified":"2024-09-16T18:44:20.000Z","tags":["T1110","T1539","T1078"],"_patchfirst":{"reason":"published","priority":15.6,"kev":null,"epss":{"score":0.01748,"percentile":0.77806},"cvss":null,"vendor":"ICS-CERT","product":"Moxa IKS, EDS","techniqueIds":["T1110","T1539","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-15800","url":"https://patchfirst.co/cve/CVE-2018-15800/","title":"CVE-2018-15800: Timing attack allows extraction of signing key in Bits Service","content_text":"Cloud Foundry · Bits Service Release. Not in CISA KEV. EPSS 0.9% (higher than 60.5% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1110 Brute Force; T1078 Valid Accounts. Priority 17.8 of 100.","summary":"Timing attack allows extraction of signing key in Bits Service","date_published":"2018-12-10T00:00:00.000Z","date_modified":"2024-09-17T03:34:23.000Z","tags":["T1110","T1078"],"_patchfirst":{"reason":"published","priority":17.8,"kev":null,"epss":{"score":0.00928,"percentile":0.60491},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"Bits Service Release","techniqueIds":["T1110","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-15795","url":"https://patchfirst.co/cve/CVE-2018-15795/","title":"CVE-2018-15795: CredHub Service Broker uses guessable client secret","content_text":"Pivotal Cloud Foundry · CredHub Service Broker. Not in CISA KEV. EPSS 1.3% (higher than 70.5% of CVEs). CVSS 8.1 HIGH. ATT&CK: T1110 Brute Force; T1078 Valid Accounts. Priority 19.8 of 100.","summary":"CredHub Service Broker uses guessable client secret","date_published":"2018-11-13T00:00:00.000Z","date_modified":"2024-09-16T16:47:36.000Z","tags":["T1110","T1078"],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.01304,"percentile":0.70483},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0"},"vendor":"Pivotal Cloud Foundry","product":"CredHub Service Broker","techniqueIds":["T1110","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-11069","url":"https://patchfirst.co/cve/CVE-2018-11069/","title":"CVE-2018-11069: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also…","content_text":"Dell EMC · RSA BSAFE SSL-J. Not in CISA KEV. EPSS 1.3% (higher than 70% of CVEs). CVSS 5.9 MEDIUM. ATT&CK: T1110 Brute Force; T1600 Weaken Encryption. Priority 18.1 of 100.","summary":"RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also…","date_published":"2018-09-11T00:00:00.000Z","date_modified":"2024-09-16T19:35:24.000Z","tags":["T1110","T1600"],"_patchfirst":{"reason":"published","priority":18.1,"kev":null,"epss":{"score":0.01278,"percentile":0.69962},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.0"},"vendor":"Dell EMC","product":"RSA BSAFE SSL-J","techniqueIds":["T1110","T1600"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-11045","url":"https://patchfirst.co/cve/CVE-2018-11045/","title":"CVE-2018-11045: Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a…","content_text":"Pivotal · Pivotal Operations Manager. Not in CISA KEV. EPSS 0.9% (higher than 58.4% of CVEs). ATT&CK: T1110 Brute Force; T1078 Valid Accounts. Priority 11.7 of 100.","summary":"Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a…","date_published":"2018-07-11T00:00:00.000Z","date_modified":"2024-09-16T22:56:33.000Z","tags":["T1110","T1078"],"_patchfirst":{"reason":"published","priority":11.7,"kev":null,"epss":{"score":0.00858,"percentile":0.58421},"cvss":null,"vendor":"Pivotal","product":"Pivotal Operations Manager","techniqueIds":["T1110","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8160","url":"https://patchfirst.co/cve/CVE-2018-8160/","title":"CVE-2018-8160: An information disclosure vulnerability exists in Outlook when a message is opened, aka \"Microsoft Outlook Information…","content_text":"Microsoft · Word. Not in CISA KEV. EPSS 8.5% (higher than 95% of CVEs). ATT&CK: T1566 Phishing; T1005 Data from Local System; T1110 Brute Force. Priority 19.0 of 100.","summary":"An information disclosure vulnerability exists in Outlook when a message is opened, aka \"Microsoft Outlook Information…","date_published":"2018-05-09T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1566","T1005","T1110"],"_patchfirst":{"reason":"published","priority":19,"kev":null,"epss":{"score":0.08461,"percentile":0.95008},"cvss":null,"vendor":"Microsoft","product":"Word","techniqueIds":["T1566","T1005","T1110"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}