2505 matches found
PT-2023-7425 · Fortinet · Fortiproxy +1
Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.0 through 7.2.3 FortiOS versions prior to 7.0.10 FortiProxy versions 7.2.0 through 7.2.2 FortiProxy versions prior to 7.0.8 Description: The issue is related to an improper restriction of excessive authentication attempts...
Protect
An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiOS & FortiProxy administrative interface may allow an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions...
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
Lack of rate limiting will allow an attacker to brute-force user credentials...
Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS
The plugin does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks import requests import sys import re if lensys.argv != 4: print'USAGE: python %s ' %...
WordPress Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)
Software Limit Login Attempts Type Plugin Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1912 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 8be93eea7b1c Credits Marco Wotschka...
CVE-2023-1912
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-1912
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-1912 Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2023-17334 · WordPress · Limit Login Attempts
Name of the Vulnerable Software and Affected Versions: Limit Login Attempts plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting via the lock logging feature due to insufficient input sanitization and output escaping. This allo...
Limit Login Attempts < 1.7.2 - Unauthenticated Stored XSS
The plugin does not sanitize and escape the IP address retrieved from headers such as X-Forwarded-For when the "Site Connection" settings is set to "From behind a reversy proxy", which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks Setup: As admin, set the...
Limit Login Attempts < 1.7.2 - Unauthenticated Stored XSS
The plugin does not sanitize and escape the IP address retrieved from headers such as X-Forwarded-For when the "Site Connection" settings is set to "From behind a reversy proxy", which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks PoC Setup: As admin, set th...
WordPress plugin Limit Login Attempts 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
Schneider Electric Wiser Smart Improper Restriction of Excessive Authentication Attempts (CVE-2022-30235)
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior This plugin only works with Tenable.ot. Please visit...
CVE-2023-1665
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0...
PT-2023-17154 · Linagora · Linagora/Twake
Name of the Vulnerable Software and Affected Versions: linagora/twake version prior to 0.0.0. Description: The issue concerns an improper restriction of excessive authentication attempts. This means that the system does not adequately limit the number of login attempts, potentially allowing for...
CVE-2023-1665 Improper Restriction of Excessive Authentication Attempts in linagora/twake
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0...
CVE-2023-1665 Improper Restriction of Excessive Authentication Attempts in linagora/twake
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0...
smartCARS 日志信息泄露漏洞
Invernyx smartCARS is an application from Invernyx Corporation. A log information disclosure vulnerability exists in smartCARS version 0.5.8 and earlier, which stems from the fact that all failed login attempts store their passwords in an error log...
CVE-2023-27100
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests...