CVE-2024-36403

CVE-2024-36403 affects Matrix Media Repo (MMR) before 1.3.5. An unauthenticated attacker can cause unbounded disk consumption by triggering MMR to download and cache large volumes of remote media. Deployments using file-backed storage or self-hosted S3 storage are vulnerable to a disk-fill denial...

CVE-2024-36403: Allocation of Resources Without Limits or Throttling

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating...

CVE-2024-37540

Cross-Site Request Forgery CSRF vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through = 4.21.2...

CVE-2024-37540

CVE-2024-37540 is a CSRF vulnerability in the WordPress plugin Leaky Paywall (versions n/a–4.21.2). The vulnerability is described as a Cross-Site Request Forgery issue affecting Leaky Paywall, with a CVSS 3.1 base score of 4.3 (Medium). Public references in the provided documents consistently ci...

CVE-2024-37540 WordPress Leaky Paywall plugin <= 4.21.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through = 4.21.2...

CVE-2024-37540 WordPress Leaky Paywall plugin <= 4.21.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Leaky Paywall Leaky Paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through 4.21.2...

CVE-2024-37540: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through = 4.21.2...

PT-2025-2502

Name of the Vulnerable Software and Affected Versions: Leaky Paywall versions through 4.21.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on a user's account without their knowledge or consent. This is due to Leaky...

WordPress plugin Leaky Paywall 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

Synapse denial of service through media disk space consumption

Impact Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging fro...

PYSEC-2024-286

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can le...

PYSEC-2024-286

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can le...

CVE-2024-37302

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can le...

PT-2024-27460

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.106 Description Synapse is an open-source Matrix homeserver. The issue allows an unauthenticated adversary to induce Synapse to download and cache large amounts of remote media, leading to a denial of service. This...

CVE-2024-37302: Allocation of Resources Without Limits or Throttling

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can le...

WordPress Leaky Paywall plugin <= 4.21.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Leaky Paywall versions = 4.21.2...

WordPress Leaky Paywall Plugin <= 4.21.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Leaky Paywall Type Plugin Vulnerable versions = 4.21.2 Fixed in 4.21.3 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-37540 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6553531150a7 Credits Ananda Dhakal Patchstack...

Leaky Paywall < 4.20.9 - Missing Authorization to Price Manipulation

Description The Leaky Paywall plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 4.20.8. This is due to the plugin allowing the price field to be user supplied. This makes it possible for unauthenticated attackers to alter the price of memberships...

CVE-2024-33594

Missing Authorization vulnerability in Leaky Paywall.This issue affects Leaky Paywall: from n/a through 4.20.8...

CVE-2024-33594

CVE-2024-33594 affects Leaky Paywall for WordPress. Connected docs confirm a Missing Authorization vulnerability that enables price manipulation of memberships in versions up to 4.20.8. The root cause is lack of authorization control over the price field, allowing unauthenticated manipulation. No...