Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form

Summary: In your sub-domain: https://demo.weblate.org/ , there's an endpoint that doesn't have any rate limit on it to prevent spamming you by filling the contact you form multiple times to bomb you with tons of emails. Description: Spamming and Possible DOS is being possible due to missing rate...

PT-2017-18030 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions through 7.1.4 Description: The issue allows attackers to cause a denial of service via operations on long strings, resulting in memory consumption and application crash. The vendor disputes this, stating that GMP safely aborts in...

CVE-2017-0583

An elevation of privilege vulnerability in the Qualcomm CP access driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and because of vulnerability...

The vulnerability of the Skype instant messaging program allows a hacker to execute arbitrary code.

The vulnerability of the Skype instant messaging program is related to the limitation on the download of external libraries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted library named api-ms-win-core-winrt-string-l1-1-0.dll, which is...

Misconfiguration in LIMIT directive of .htaccess file

There are a number of HTTP methods that can be used on a webserver for example OPTIONS, HEAD, GET, POST, PUT, DELETE etc.. Each of these methods perform a different function, and each has an associated level of risk when their use is permitted on the webserver. The directive within Apache's...

Web Application Sitemap

Publishes the sitemap of the web application as seen by the scan. The list of all URLs that have been detected during the scan are available as an attachment. For each URL in the sitemap, the following information is provided: - The first time the URL is detected - The logic used to detect the UR...

RHEL 6 : Red Hat Gluster Storage 3.2.0 (RHSA-2017:0484)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0484 advisory. Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies dat...

filtron - Filtering reverse HTTP proxy

Reverse HTTP proxy to filter requests by different rules. Can be used between production webserver and the application server to prevent abuse of the application backend. The original purpose of this program was to defend searx , but it can be used to guard any web application. Installation and...

File upload fails if the file size is Greater than 65k when ssl policy is bound to the ADC LBVIP

Can upload files of size only up to 64K 2. Cannot upload files larger than 64K upload stalls 3. SSL Policy with Action is bound to LB Vserver...

UBUNTU-CVE-2017-6470

In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness...

SUSE-SU-2017:0603-1 Security update for openssh

This update for openssh fixes the following issues: Security issues fixed: - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of...

DEBIAN-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

UBUNTU-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

YouTube encrypted video there are multiple universal password can bypass the limit(wonderful vulnerability)-vulnerability warning-the black bar safety net

YouTube encrypted Video, a plurality of universal password Detailed description: As long as the Password box, enter the two English double quotation marks. For example: "" press the OK button to play all the encrypted videos. Management added: "" \ %% or a=a And other characters can bypass video...

Munin Local File Write Vulnerability

Munin is a set of network resource monitoring tools. The tool monitors core system resources including memory, disk, CPU usage, server applications and more. A local file write vulnerability exists in Munin versions prior to 2.999.6. An attacker can exploit the vulnerability by setting multiple...

DEBIAN-CVE-2017-6188

Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upperlimit GET parameters allows overwriting any file accessible to the www-data user...

UBUNTU-CVE-2017-6188

Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upperlimit GET parameters allows overwriting any file accessible to the www-data user...

WordPress: Wordpress 4.7.2 - Two XSS in Media Upload when file too large.

Description ------------------- An attacker can inject a malicious script in to the filename which a victim tries to upload leading to XSS inside the administrators control panel. Two different "file to large" cases end up in interpolating the file name and appending it into DOM unsanitized leadi...

kernel: pipe: limit the per-user amount of pages allocated in pipes

It is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4096 pipes with 1 MB of data will use 4 GB of memory and there can be multiple such processes, up to a per-user-limit...

Buffer Overflow

ImageMagick is vulnerable to buffer overflows. When a memory limit is set, a malicious user can trigger a heap-based buffer overflow or cause a invalid write operation via the SetPixelIndex function...