CVE-2024-31105

CVE-2024-31105 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Tax Rate Upload that enables Reflected XSS. The entry lists affected software as Tax Rate Upload (n/a) up to version 2.4.5. Reported metrics (CVSS v3.1 base score 7.1, HIGH) indicate network attack vector,...

CVE-2024-31105 WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5...

DEBIAN-CVE-2024-26668

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlimit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this...

CVE-2024-26668 netfilter: nft_limit: reject configurations that cause integer overflow

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlimit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this...

WordPress Plugin Tax Rate Upload 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2024-23774 · Unknown · Adam Bowen Tax Rate Upload

Name of the Vulnerable Software and Affected Versions: Adam Bowen Tax Rate Upload versions n/a through 2.4.5 Description: A Cross-Site Request Forgery CSRF issue in Adam Bowen Tax Rate Upload allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on the w...

CVE-2024-31105: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5...

BIT-DISCOURSE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

BIT-ARGO-CD-2024-21662 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combine...

WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability

CSRF leading to Cross Site Scripting XSS vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Tax Rate Upload versions = 2.4.5...

PT-2024-13701 · Stilog · Stilog Visual Planning

Name of the Vulnerable Software and Affected Versions: Stilog Visual Planning version 8 Description: An authentication bypass issue was found, allowing an unauthenticated attacker to brute-force the password reset PINs of administrative users. Recommendations: For Stilog Visual Planning version 8...

WordPress Tax Rate Upload Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Tax Rate Upload Type Plugin Vulnerable versions = 2.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31105 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 687c051f0fb1 Credits thiennv Required privilege...

Improper Restriction Of Excessive Authentication Attempts

github.com/argoproj/argo-cd/ is vulnerable to Improper Restriction Of Excessive Authentication Attempts. This vulnerability is due to a weak cache-based mechanism that allows attackers to bypass rate limit and brute force protections, which can result in account compromise...

GO-2024-2652 Brute force protection bypass in github.com/argoproj/argo-cd/v2

An attacker can effectively bypass the rate limit and brute force protections in Argo CD by exploiting the application's weak cache-based mechanism. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. An attacker can overflow this cache b...

Discourse Denial of Service Vulnerability (CNVD-2024-14304)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a denial of service vulnerability that stems from the POST /uploads endpoint not being rate-limited. An attacker could exploit this vulnerabili...

Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

Summary An attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a previously patched CVE...

GHSA-2VGG-9H6W-M454 Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

Summary An attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a previously patched CVE...

CVE-2024-21662

A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a defaultMaxCacheSize of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different...

CVE-2024-21662

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combine...

CVE-2024-21662

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combine...