PT-2023-7208 · Symfony · Symfony

Name of the Vulnerable Software and Affected Versions: Symfony versions 5.4.21 through 5.4.30 Symfony versions 6.2.7 through 6.3.7 Description: The issue is related to the incorrect management of sessions by the SessionStrategyListener function in the Symfony platform. This can allow a remote...

CVE-2023-4631

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CentOS 8 : grafana (CESA-2023:2784)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:2784 advisory. - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closin...

Rate-limit Bypass

azuracast/azuracast is vulnerable to rate-limit Bypass. The vulnerability exists due to a lack of user request rate limiting when the request headers include random values, which allows an attacker to bypass the login security mechanism...

PT-2023-12944 · Totolink Technology · Totolink Cpe

Name of the Vulnerable Software and Affected Versions: TOTOLINK Technology CPE version V6.3c.566 Description: The issue allows remote attackers to bypass login, potentially granting unauthorized access. Recommendations: For TOTOLINK Technology CPE version V6.3c.566, consider disabling remote logi...

CVE-2023-24426

Jenkins Azure AD Plugin 303.va91ef20ee49f and earlier does not invalidate the previous session on login...

WP Limit Login Attempts <= 2.6.4 - IP Spoofing

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based restrictions on login forms. Set HTTPCLIENTIP or HTTPXFORWARDEDFOR as used in wplimitgetip to spoof the IP address and bypass the block...

CVE-2022-1579 Login Block IPs <= 1.0.0 - IP Spoofing Bypass

The function checkisloginpage uses headers for the IP check, which can be easily spoofed...

CVE-2022-22472

IBM Spectrum Protect Plus Container Backup and Restore 10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session...

CVE-2022-22472

IBM Spectrum Protect Plus Container Backup and Restore 10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session...

Security Bulletin: IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift vulnerable to login security bypass (CVE-2022-22472)

Summary BM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift is vulnerable to login security being bypassed which can result in gaining unauthorized access to the IBM Spectrum Protect Plus Server. Vulnerability Details CVEID:CVE-2022-22472 DESCRIPTION: IBM...

CVE-2022-22472

IBM Spectrum Protect Plus Container Backup and Restore 10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session...

GHSA-V969-5V7F-PMG2 TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

CVE-2021-41807

The CVE-2021-41807 issue affects M-Files Server and M-Files Web prior to version 21.12.10873.0. Root cause: lack of rate limiting on certain user accounts enables unlimited login attempts, facilitating brute-forcing of accounts. Impact is a high-severity authentication weakness with potential for...

CVE-2021-43471

In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability...

CVE-2021-33209

An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, helping an attacker to enumerate usernames. This can make a brute-force attack easier...

ZOHO ManageEngine Log360 Cross-Site Request Forgery Vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.A cross-site...

ZOHO ManageEngine Log360 跨站请求伪造漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.A cross-site...

Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting

The plugin does not escape the IP addresses which can be controlled by attacker via headers such as X-Forwarded-For of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue. POST /wp-login.php HTTP/1.1 Accept:...

CVE-2021-24328

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them a...