matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content

Impact MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated wa...

GHSA-GJGR-7834-RHXR Synapse's unauthenticated writes to the media repository allow planting of problematic content

Impact Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticate...

Synapse's unauthenticated writes to the media repository allow planting of problematic content

Impact Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticate...

Synapse denial of service through media disk space consumption

Impact Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging fro...

Password Pusher 安全漏洞

Password Pusher is an open source application by Peter Giacomo Lombardo, an individual developer, used to deliver sensitive information over the web. A security vulnerability exists in Password Pusher prior to v1.49.0, which stems from the ability to bypass the rate limiter by spoofing the proxy...

icmp: change the order of rate limits

...

CVE-2024-47678

A flaw was found in the Linux kernel related to the order of rate limits for ICMP messages. The sequence in which rate limiters are applied potentially allows a side-channel attack, resulting in information disclosure. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-47678

In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1 host wide ratelimit icmpglobalallow 2 Per destination ratelimit inetpeer based In...

CVE-2024-47678 icmp: change the order of rate limits

In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1 host wide ratelimit icmpglobalallow 2 Per destination ratelimit inetpeer based In...

CVE-2024-47678

In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1 host wide ratelimit icmpglobalallow 2 Per destination ratelimit inetpeer based In...

CVE-2024-47678 icmp: change the order of rate limits

In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1 host wide ratelimit icmpglobalallow 2 Per destination ratelimit inetpeer based In...

kernel: netfilter: nft_limit: reject configurations that cause integer overflow

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlimit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this...

Exploit for CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaitenhttps://kait...

Ghost CMS Security Vulnerability

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A security vulnerability exists in Ghost CMS version 5.85.1 and earlier, which originates from a remote attacker bypassing the authentication rate-limiting protection...

K000139229: Tempesta vulnerability CVE-2024-2758

Security Advisory Description Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately. CVE-2024-2758 Impact There is no impact; F5 products are not affected by this...

The vulnerability of the extension of the Wikibase software for implementing the MediaWiki hypertext environment allows a hacker to cause a service failure.

The vulnerability of the extension of the Wikibase software for implementing the MediaWiki hypertext environment is related to the lack of speed limits on the merging of elements. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758 CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...