CVE-2020-18698

The CVE-2020-18698 entry concerns Lin-CMS-Flask v0.1.1 with an improper authentication flaw in the login path (component app/api/cms/user.py). The vulnerability enables remote brute-force login attempts without restriction. NVD/mitigations indicate an extremely high impact under CVSS-3.1: User au...

CVE-2020-18698: Improper Restriction of Excessive Authentication Attempts

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'...

CVE-2020-18701: Incorrect Authorization

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets...

TaleLin Lin-CMS-Flask 访问控制错误漏洞

TaleLin Lin-CMS-Flask is a content management system framework. an access control error vulnerability exists in TaleLin Lin-CMS-Flask, stemming from incorrect access control in Lin-CMS-Flask v0.1.1, which could be exploited by an attacker to obtain sensitive information and/or because the...

PT-2021-10215 · Unknown · Lin-Cms-Flask

Name of the Vulnerable Software and Affected Versions: Lin-CMS-Flask version 0.1.1 Description: The issue allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying...

lin-cms-flask安全漏洞

lin-cms-flask is a content management system framework. lin-cms-flask version 0.1.1 contains a security vulnerability that can be exploited by remote attackers to brute force login via the "login" function in the component "app/api/cms/user.py"...

PT-2021-10213 · Unknown · Lin-Cms-Flask

Name of the Vulnerable Software and Affected Versions: Lin-CMS-Flask version 0.1.1 Description: The issue allows remote attackers to launch brute force login attempts without restriction via the login function in the component app/api/cms/user.py. This enables attackers to attempt multiple logins...

CVE-2020-18699: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'...