UhOh365

UhOh365 이 스크립트는 Office365에서 이메일 주소가 유효한지 확인할 수 있습니다. 로그인 시도를 전혀 수행하지 않으며, 제한이 없으며, 소셜 엔지니어링 평가에서 어떤 이메일이 존재하고 존재하지 않는지 찾는 데 매우 유용합니다. Microsoft는 "이메일 열거"를 취약점으로 간주하지 않으므로, 이는 "기능"을 활용하는 것입니다. 공개된 Office365 이메일 검증 스크립트가 몇 가지 더 있지만, 제가 본 것들은 모두 사용자 계정당 최소 1번의 로그인 시도가 필요합니다. 이는 감지 가능 하며 여러 계정에 대해 1개...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

CVE-2026-93616_Checks

インストール compromise-check.sh を Check Point Management サーバーに移動します chmod +x compromise-check.sh シェルスクリプト compromise-check.sh を含むディレクトリから、Check Point 管理サーバー上で Expert モードでこれらのコマンドを実行します。 SmartDashboard スクリプト smartdashboardrunscript.sh は、SmartDashboard からマネージャーに移動し、run script をクリックしてこのコードを貼り付けるだけで実行できます...

CVE-2020-35590

エクスプロイト情報 エクスプロイトタイトル: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - ログイン制限バイパス CVE: CVE-2020-35590 日付: 2020-06-09 エクスプロイト作成者: N4nj0 ソフトウェアリンク: https://wordpress.org/plugins/limit-login-attempts-reloaded/ バージョン: 2.13.0 テスト環境: WordPress 5.4.1, 5.4.2 脆弱性勧告:...

CVE-2023-4800

CVE ID: CVE-2023-4800 脆弱性タイプ: 機密データの露出 説明: WordPress用DoLogin Securityプラグインは、バージョン3.7以前（3.7を含む）において、ダッシュボードウィジェットのcapabilityチェックが欠如しているため、データへの不正アクセスに対して脆弱です。これにより、認証済みの攻撃者がログイン試行ログを閲覧できる可能性があります。 再現手順: プラグインを有効にし、認証されたユーザーとしてダッシュボードに移動します。 参照: 1...

CVE-2024-34070

CVE-2024-34070 Froxlor PoC Python による CVE-2024-34070 の概念実証 PoC です。これは、Froxlor 2.1.9 より前のバージョンにおいて、システムログに書き込まれるログイン失敗試行を介した格納型 XSS の問題です。 警告 このプロジェクトは、許可を得たセキュリティテスト、CTFラボ、教育目的でのみ使用してください。所有していないシステムや、テストする明示的な許可を得ていないシステムに対して実行しないでください。エクスプロイトモードでは、対象の Froxlor インスタンスに管理者アカウントを作成できます。 特徴 Froxlor...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module 설명 The Ultimate WordPress Toolkit – WP Extended 플러그인은 WordPress용으로, 로그인 시도 모듈을 통해 모든 버전최대 3.0.12 포함에서 시간 기반 SQL 인젝션에 취약합니다. 이는 사용자가 제공한 매개변수에 대한 이스케이프 처리 부족과 기존 SQL 쿼리에 대...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks because, by default, it does not limit the number of failed login attempts. The attack vector is adjacent network (AV:A) with low complexity and no privileges required, rated CVSS 4.0 6.3 (MEDIUM) with low confidential impact on the vulnera...

Astra Linux – Vulnerability in Zabbix

The Zabbix API’s user.get method returns all users that share a common group with the calling user. This includes media and other information, such as login attempts, etc...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions of xrdp prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of maximum login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However,...

CVE-2026-89174

The Smart Video Intercom System developed by Kingdom Communication Associated suffers from a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts by performing a large number of login attempts, resulting in a high confidentiality impact ...

CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

WordPress Limit Login Attempts Security plugin < 3.3.5 - Username Denylist Bypass vulnerability

Username Denylist Bypass vulnerability discovered by Artus KG in WordPress Plugin Limit Login Attempts Reloaded versions 3.3.5...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

EUVD-2026-63912

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...