CLSA-2023-1683235231 openssl: Fix of 3 CVEs

CVE-2023-0464: Fix excessive resource use verifying X.509 policy constraints - CVE-2023-0466: Fix documentation of X509VERIFYPARAMadd0policy - CVE-2022-3996: Drop redundant flag setting in policycachesetmapping...

CVE-2022-3405

Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 29486, Acronis Cyber Backup 12.5 Windows, Linux before build 16545...

CVE-2023-23837

No exception handling vulnerability which revealed sensitive or excessive information to users...

Imperva Unveils Latest API Security Enhancements

Imperva is continuing to evolve its API Security offering to help customers better protect their APIs, wherever they are, and to meet changing market requirements. Since launching API Security in March 2022, we continued investing in our API Security offering with the goal of simplifying the...

PT-2023-19244 · Solarwinds · Database Performance Analyzer

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A no exception handling issue has been identified, which potentially reveals sensitive or excessive information to users. Recommendations: At the moment, there is no information abo...

CVE-2023-30798 MultipartParser DOS with too many fields or files in Starlette Framework

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...

CVE-2023-30798

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...

CVE-2023-22645 kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role

An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions prior to 1.6.0...

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 V4.7.0 and prior...

Authentication flaw

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 V4.7.0 and prior...

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 V4.7.0 and prior...

CVE-2022-43377

CVE-2022-43377 affects Schneider Electric NetBotz 4 (versions ≤ 4.7.0). The root cause is CWE-307: improper restriction of excessive authentication attempts, enabling potential account takeover via brute force over the network. Affected: NetBotz 4 355/450/455/550/570 (V4.7.0 and prior). CVSSv3.1 ...

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 V4.7.0 and prior...

CVE-2022-2525

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

CVE-2022-2525 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

CVE-2022-2525 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

CVE-2022-2525

Summary (CVE-2022-2525): Calibre-Web (janeczku/calibre-web) before version 0.6.20 is affected by an improper restriction of excessive authentication attempts. The issue is described as high-severity with potential Full impact if exploited, as reflected by CVSS vectors (e.g., 3.1/AV:N/AC:L/PR:N/UI...

Anti brute-force bypass in administrative interface

...

Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

Lack of rate limiting will allow an attacker to brute-force user credentials...

SUSE: Security Advisory (SUSE-SU-2023:1790-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...