py-matrix-synapse -- users of single-sign-on are vulnerable to phishing

Matrix developers report: The 1.11.1 release includes a security fix impacting installations using Single Sign-On i.e. SAML2 or CAS for authentication. Administrators of such installations are encouraged to upgrade as soon as possible...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

Authentication flaw

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

PYSEC-2020-249

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

PYSEC-2020-249

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

CVE-2013-1895

The CVE-2013-1895 entry concerns the py-bcrypt package for Python, specifically before version 0.3. The issue is a race/concurrency flaw: the module does not properly handle concurrent memory access, which allows attackers to bypass authentication by issuing multiple authentication attempts that ...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

PT-2020-7373

Name of the Vulnerable Software and Affected Versions: py-bcrypt versions prior to 0.3 Description: The issue arises from improper handling of concurrent memory access in the py-bcrypt module, allowing attackers to bypass authentication. This is achieved through multiple authentication requests...

CVE-2013-1895: Improper Restriction of Excessive Authentication Attempts

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2019-19911 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2019-19911 Source advisory: OSV:PYSEC-2020-172...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5311 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5311 Source advisory: OSV:PYSEC-2020-82...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5313 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5313 Source advisory: OSV:PYSEC-2020-84...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2020-5312 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2020-5312 Source advisory:...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5310 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5310 Source advisory: OSV:PYSEC-2020-81...

FreeBSD : py-matrix-synapse -- multiple vulnerabilities (ed8cbad5-21a8-11ea-9b6d-901b0e934d69)

Matrix developers report : The synapse 1.7.1 release includes several security fixes as well as a fix to a bug exposed by the security fixes. All previous releases of Synapse are affected. Administrators are encouraged to upgrade as soon as possible. - Fix a bug which could cause room events to b...

Telerik UI - Remote Code Execution via Insecure Deserialization Exploit

Exploit for asp platform in category web applications Telerik UI - Remote Code Execution via Insecure Deserialization Exploit See the full write-up at Bishop Fox, CVE-2019-18935: https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui, for a complete walkthrough of...