3708 matches found
EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-2292)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...
Fedora 38 : golang-github-schollz-croc / golang-github-schollz-mnemonicode (2023-ac4651c9b2)
The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-ac4651c9b2 advisory. croc 9.6.4 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue b...
CVE-2023-32224
D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts...
json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)
A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...
CVE-2023-32224 D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts
D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts...
CVE-2023-32224
D-Link DSL-224 router (firmware version 3.0.10) is affected by CWE-307: Improper Restriction of Excessive Authentication Attempts. The vulnerability enables authentication bypass due to inadequate restriction on repeated authentication attempts in the device’s login mechanism. Reported across mul...
CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to...
Brute force protection allows to send more requests than intended
None...
The vulnerability of IBM TXSeries software for multiplatforms, including IBM CICS TX Standard and IBM CICS TX Advanced application servers, allows attackers to gain unauthorized access to confidential information.
The vulnerability of IBM TXSeries software for multiplatforms, including IBM CICS TX Standard and IBM CICS TX Advanced, is related to excessive data output by the application. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to confidential information from a...
Apache Commons FileUpload - DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option...
CVE-2023-26432
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server...
CVE-2023-26434
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server...
CVE-2023-26434
CVE-2023-26434 affects Open-Xchange App Suite (OX App Suite): the vulnerability arises from processing of POP3 capabilities responses without enforcing plausible size limits when adding an external mail account. An attacker with access to a rogue POP3 service could cause excessive resource usage,...
CVE-2023-26433
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server...
CVE-2023-26432
The CVE-2023-26432 issue affects Open-Xchange OX App Suite, specifically the OXAS-BACKEND SMTP capabilities handling when adding an external mail account. The root cause is processing of SMTP server capabilities not being limited to plausible sizes, enabling an attacker with access to a rogue SMT...
CVE-2022-42478
An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...
Input validation
An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...
CVE-2022-42478
"CVE-2022-42478" affects FortiSIEM prior to 7.0.0 and describes an improper restriction of excessive authentication attempts that could let a non-privileged user brute‑force endpoints. The issue is tied to FortiSIEM’s authentication controls and may allow targeted endpoints to be attacked. The co...
CVE-2022-42478
An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...
