74 matches found
CVE-2024-21652
Argo CD prior to versions 2.8.13, 2.9.9, and 2.10.4 is affected by a multi-facet issue where a chain of vulnerabilities, including a Denial of Service and in-memory data storage weakness, can bypass the brute-force login protection. This enables unlimited login attempts and can crash the service,...
PT-2024-2261 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.8.13 Argo CD versions prior to 2.9.9 Argo CD versions prior to 2.10.4 Description: The issue arises from a chain of vulnerabilities, including a Denial of Service DoS flaw and in-memory data storage weakness,...
WP Photo Album Plus < 8.6.01.005 - IP Spoofing
Description The plugin does not properly check for IP addresses, allowing attackers to spoof IP addresses via headers and bypass the login protection offered by the plugin...
CVE-2023-40834
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter...
CVE-2023-40834
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter...
CVE-2023-40834
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter...
PT-2023-27662 · Unknown · Opencart Cms
Name of the Vulnerable Software and Affected Versions: OpenCart CMS version 4.0.2.2 Description: The issue is related to a lack of protection against excessive login attempts on the login page, allowing unauthenticated attackers to perform a brute force attack to gain access to the application...
PT-2023-22091 · Unknown · @Fastify/Passport +1
Name of the Vulnerable Software and Affected Versions: @fastify/passport versions prior to the version that regenerates sessionId upon login Description: Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management...
PT-2023-19943
Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.0 Description The issue concerns the lack of rate limits in Kiwi TCMS, making it easier for attackers to attempt brute-force attacks against the login page. Recommendations For versions prior to 12.0, upgrade to...
CVE-2021-41171
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...
CVE-2021-24194
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
CVE-2021-24194
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
Code injection
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
CVE-2021-24194 Login Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
PT-2021-15739
Name of the Vulnerable Software and Affected Versions: Login Protection - Limit Failed Login Attempts WordPress plugin versions prior to 2.9 Description: The issue allows low-privileged users to exploit the AJAX action 'cp plugins do button job later callback' to install any plugin, including...
CVE-2021-24194: Improper Authorization
Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog...
WordPress plugin Login Protection - Limit Failed Login Attempts 安全漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WordPress plugin 2.9 prior to the version Login Protectio...
WordPress Login Protection – Limit Failed Login Attempts plugin <= 2.8 - Arbitrary Plugin Installation and Activation vulnerability
Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress Login Protection – Limit Failed Login Attempts plugin versions = 2.8. Solution Update the WordPress Login Protection – Limit Failed Login Attempts plugin to the latest available version at least 2.9...
CVE-2020-26251
Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...