CWE-645 vulnerabilities

Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 have an overly restrictive account lockout mechanism vulnerability. This flaw could allow an unauthenticated remote attacker to cause a denial of service by triggering account lockouts. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 5.3 (medium severity). No patches or vendor advisories are provided to confirm remediation status.

### **Impact** An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: * Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout. Applications that do not use Payload local authentication are not affected. ### **Patches** Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.