CVE-2023-4631

CVE ID : CVE-2023-4631 漏洞类型 : IP地址欺骗 描述 : WordPress的DoLogin Security插件在版本3.6及之前版本中存在IP地址欺骗漏洞。这是由于在请求日志记录和登录限制时，对IP地址信息获取位置的限制不足。攻击者可以提供带有不同IP地址的X-Forwarded-For头部，该地址将被记录，并可用于绕过已阻止某个IP地址登录的设置。 复现步骤 : 1. 发送带有x-forwarded-for头部的登录请求，例如 X-Forwarded-For: 8.8.8.8。 2. 在“登录尝试日志”中看到被伪造的IP地址。 参考链接 : 1...

CVE-2022-4539

使用注意事项： 适应性： 您可以轻松修改有效载荷、IP 生成逻辑和代理，以匹配不同的场景或环境。 道德使用： 确保在测试任何系统前已获得明确授权。 可扩展性： 本代码设计为可扩展且适应性强，既适用于小规模测试，也适用于更复杂的大型评估。 WordPress 的 Web 应用程序防火墙插件在 2.1.2 及之前版本中存在 IP 地址欺骗漏洞。这是因为在请求日志记录和登录限制中，获取 IP 地址信息的位置限制不足。攻击者可以提供带有不同 IP 地址的 X-Forwarded-For 标头，该地址将被记录，并可用来绕过可能已阻止某个 IP 地址或国家/地区登录的设置。...

EUVD-2026-53395

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

PYSEC-2026-1711 Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...

SUSE CVE-2026-0999

Mattermost versions 11.1.x = 11.1.2, 10.11.x = 10.11.9, 11.2.x = 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548...

GO-2026-4520 Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server

Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2026-0999

Technical details beyond the summary are not provided in the supplied documents. Monitor for updates from Mattermost advisory MMSA-2025-00548.

Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120

This module enables you to apply time-based login restrictions and display related warning or logout confirmation pages. The module doesn't sufficiently protect its confirmation routes from cross-site request forgery CSRF, allowing the logout confirmation route to be triggered without user...

EUVD-2013-2153

Malware in sbrugna...

EUVD-2017-18221

Malware in sbrugna...

EUVD-2023-33788

Malicious code in bioql PyPI...

EUVD-2022-51868

Malicious code in bioql PyPI...

EUVD-2022-51869

Malicious code in bioql PyPI...

CVE-2023-2282

Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector...

CVE-2022-4536

The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...

CVE-2022-4529

The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can...

Binary Vulnerability in H3C Magic R3000 Gigabit Dual Band Wi-Fi 6 Router from Xinhua San Technology Co.

Xinhua San Technology Co., Ltd. is a global leader in digital solutions. A binary vulnerability exists in the H3C Magic R3000 Gigabit Dual Band Wi-Fi 6 Router from Xinhua San Technologies Limited, which can be exploited by attackers to bypass login restrictions...

CVE-2024-48872

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, and 9.5.x = 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being...

CVE-2022-4534 Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass

The Limit Login Attempts Spam Protection plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can suppl...

PT-2024-32715 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue is due to missing restrictions for incorrect login attempts on the API-based login of the Shilpi Client Dashboard. A remote attacker could exploit this by...