5202 matches found
Security Bulletin: IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability (CVE-2021-20427)
Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2021-20427 DESCRIPTION: IBM Security Guardium uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. CVSS Base score: 5.3 CVSS Temporal Score: See...
ROS-2-545
2.545 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
ROS-2-498
2.498 Multiple Vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
Inefficient Regular Expression Complexity in vuelidate/vuelidate
✍️ Description A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an excessive amount of CPU. 🕵️♂️ Proof of Concept Create the following...
Excessive memory usage in tokio-rustls
tokio-rustls does not call processnewpackets immediately after read, so the expected termination condition wantsread always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS...
CVE-2021-29802
IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses...
Privilege Escalation
github.com/hashicorp/vault is vulnerable to privilege escalation. An underlying database file associated with the Integrated Storage feature are insecurely opened with excessive permissions...
golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this vulnerability is to system availability...
Security update for apache-commons-compress (important)
openSUSE Security Update: Security update for apache-commons-compress Announcement ID: openSUSE-SU-2021:1115-1 Rating: important References: 1188463 1188464 1188465 1188466 Cross-References: CVE-2021-35515 CVE-2021-35516 CVE-2021-35517 CVE-2021-36090 CVSS scores: CVE-2021-35515 NVD : 7.5...
Design/Logic Flaw
In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessiv...
CVE-2021-38311
In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessiv...
No Restriction of Excessive Authentication Attempts in Firefly III
firefly-iii is vulnerable to Improper Lack of Restriction of Excessive Authentication Attempts...
GHSA-7HFM-57QF-J43Q Excessive Iteration in Compress
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package...
firefly-iii has unspecified vulnerabilities
firefly-iii is a free and open source personal finance manager. firefly-iii suffers from a security vulnerability that stems from the program being susceptible to undue restrictions on excessive authentication attempts. No detailed vulnerability details are currently available...
Improper Restriction of Excessive Authentication Attempts in Argo API
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence. Specific Go Packages Affected...
GHSA-XCQR-9H24-VRGW Improper Restriction of Excessive Authentication Attempts in Argo API
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence. Specific Go Packages Affected...
Insecure Authentication
firefly-iii has insecure authentication. The vulnerability exists due to Improper Restriction of Excessive Authentication Attempts allowing an attacker to be able to gain access through brute forcing the login with a correct password list...
CVE-2021-3663
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts...