GHSA-9WQR-9787-P4RF Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password

In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available...

Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password

In the login API, an IP address will by default be blocked when the user tries to login incorrectly more than 5 times. However, a bypass to this mechanism is possible by abusing a X-Forwarded-For header to bypass IP detection and perform a password brute-force. A patch for this issue is available...

CVE-2022-2368

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

CVE-2022-2368

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

Authentication flaw

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

CVE-2022-2368 Authentication Bypass by Spoofing in microweber/microweber

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

CVE-2022-2368 Authentication Bypass by Spoofing in microweber/microweber

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

CVE-2022-2368

CVE-2022-2368 affects microweber/microweber prior to 1.2.20. The issue is an authentication bypass by spoofing: the login API blocks an IP after more than 5 failed attempts, but this can be bypassed by manipulating the X-Forwarded-For header, enabling password brute-force attempts. Public sources...

Microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 1.2.20, which can be...

CVE-2022-2368: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20...

GHSA-GMH3-X5W7-JG5M Microweber before v1.2.20 vulnerable to cross-site scripting

Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery CSRF, fetch contents from same-site and redirect a user...

Microweber before v1.2.20 vulnerable to cross-site scripting

Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery CSRF, fetch contents from same-site and redirect a user...

CVE-2022-2353

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

CVE-2022-2353

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

Cross site request forgery (csrf)

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

CVE-2022-2353

CVE-2022-2353 affects microweber/microweber prior to v1.2.20. The root cause is improper neutralization of input, enabling an attacker to steal tokens and perform cross-site request forgery, fetch contents from the same-site, and redirect a user. Impact is described as token theft and CSRF-relate...

CVE-2022-2353 Cross-Site Request Forgery (CSRF) in microweber/microweber

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

Microweber 跨站请求伪造漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in Microweber versions prior to v1.2.2...

CVE-2022-2353: Cross-Site Request Forgery (CSRF)

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

PT-2022-16055 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.20 Description: The issue is due to improper neutralization of input, allowing an attacker to steal tokens and perform cross-site request forgery, fetch contents from the same site, and redirect a...