Low: Red Hat Security Advisory: OpenShift Container Platform 3.10 mediawiki security update

An update for mediawiki is now available for Red Hat OpenShift Container Platform 3.10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Craft CMS Rate Limiting / Brute Force

Exploit Title : Craft CMS up to 3.1.7 Password Prompt Form Lockout weak authentication Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Private Limited Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 16-01-2019 Vendor...

Moneybird: Bypass password reset rate limit protection at moneybird.com/passwords

Attacker found a way to completely bypass our rate limit protection, allowing for other types of attacks. This involved changing the value of the X-Forwarded-For header. Attacker never got a 429 response from our servers when the value for each request is different. Injecting X-Forwarded-For :...

Arjun v1.6 - HTTP Parameter Discovery Suite

Introduction Web applications use parameters or queries to accept user input, take the following example into consideration http://api.example.com/v1/userinfo?id=751634589 This URL seems to load user information for a specific user id, but what if there exists a parameter named admin which when s...

Insecure Authentication Mechanism

craftcms/cms is uses an insecure authentication mechanism. There is no account lockout after multiple failed attempts to log-in and the application does not rate-limit the elevated session password prompt, allowing an attacker to perform a brute-force attack on the log-in function and discover...

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

mediawiki: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'...

Factoring 2048-bit Numbers Using 20 Million Qubits

This theoretical paper shows how to factor 2048-bit RSA moduli with a 20-million qubit quantum computer in eight hours. It's interesting work, but I don't want overstate the risk. We know from Shor's Algorithm that both factoring and discrete logs are easy to solve on a large, working quantum...

apls (>=0.0.6 <=0.1.0), datacube (=1.6.2) +16 more potentially affected by CVE-2019-17545 via gdal (>=2.1.0 <=3.0.1)

gdal PYPI version =2.1.0, =0.0.6, =0.1.0, =0.0.35, =0.1.0, =1.0.60, =0.0.4, =0.1.2, =1.0.16, =0.9.0, =0.0.6, =0.0.3, =0.1.0 - routing-ortools-osrm =1.0.1 and more Source cves: CVE-2019-17545 Source advisory: OSV:PYSEC-2019-241...

EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2066)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number o...

CVE-2019-6833

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU, which could cause a temporary freeze of the HMI when a high rate of frames is receive...

Design/Logic Flaw

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU, which could cause a temporary freeze of the HMI when a high rate of frames is receive...

CVE-2019-6833

CVE-2019-6833 affects Schneider Electric Magelis HMI Panels (HMIGTO/HMISTO/XBTGH/HMIGTU/HMIGTUX/HMISCU/HMISTU/XBTGT/XBTGC/HMIGXO/HMIGXU), where a high rate of frames can cause a temporary HMI freeze; after the rate subsides, buffered commands are processed. Affected firmware versions: all listed ...

CVE-2019-6833

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU, which could cause a temporary freeze of the HMI when a high rate of frames is receive...

CVE-2019-6833

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU, which could cause a temporary freeze of the HMI when a high rate of frames is receive...

EulerOS 2.0 SP5 : wavpack (EulerOS-SA-2019-1901)

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource...

EulerOS 2.0 SP2 : wavpack (EulerOS-SA-2019-1874)

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource...

MGASA-2019-0279 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: Potential XSS in jQuery CVE-2019-11358. An account can be logged out without using a token CSRF CVE-2019-12466. A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them CVE-2019-12467. Directly...