PT-2015-7942

Name of the Vulnerable Software and Affected Versions m2crypto affected versions not specified Description A bug was found in the pbkdf2 function of the m2crypto package. When given a 74 byte result, a buffer overflow occurs, leading to a crash of the application. Recommendations At the moment,...

CollabNet Subversion Edge weak password storage mechanism

Vuln Title: The CollabNet Subversion Edge stores passwords as unsalted MD5 hashes Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Insecure password storage Risk: Medium Status: public/fixed...

Fedora 22 : mediawiki-1.24.2-1.fc22 (2015-5511)

Changes since 1.24.1 - bug T85848, bug T71210 SECURITY: Don't parse XMP blocks that contain XML entities, to prevent various DoS attacks. - bug T85848 SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce likelihood of DoS. - bug T88310 SECURITY: Always expand xml entities when...

CVE-2015-2936

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

Default credentials

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

CVE-2015-2936

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

CVE-2015-2936

MediaWiki 1.24.x before 1.24.2 is affected by CVE-2015-2936 due to a vulnerability in PBKDF2 password hashing that allows remote attackers to cause a denial of service (CPU consumption) via a long password. Exploitation is remote and could impact availability. The remedial action is to upgrade to...

CVE-2015-2936

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

CVE-2015-2936

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

CVE-2015-2936: Undefined Security Weakness

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

mediawiki: multiple issues

CVE-2015-2931 cross-side scripting It was discovered that MIME types were not properly restricted, allowing a way to circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in a SVG file. - CVE-2015-2932 cross-side scripting The SVG filter to prevent...

Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: In MediaWiki before 1.23.9, one could circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in the SVG CVE-2015-2931. In MediaWiki before 1.23.9, the SVG filter to prevent injecting JavaScrip...

PT-2015-5986

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.24.x through 1.24.1 Description The issue allows remote attackers to cause a denial of service, specifically consuming CPU resources, by providing a long password when the PBKDF2 algorithm is used for password hashing...

CVE-2013-5958

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

Design/Logic Flaw

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

CVE-2013-5958

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

CVE-2013-5958

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

CVE-2013-5958

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

PT-2014-3009

Name of the Vulnerable Software and Affected Versions Symfony versions 2.0.x through 2.0.24 Symfony versions 2.1.x through 2.1.12 Symfony versions 2.2.x through 2.2.8 Symfony versions 2.3.x through 2.3.5 Description The issue allows remote attackers to cause a denial of service, specifically CPU...

CVE-2013-5958: Undefined Security Weakness

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...