Skip to content
OpenAdvisories

Archive

24 August 2015

Vulnerabilities first published on this day (UTC), newest first.

4 results · Clear filters · Feed

  • High 7.5

    Denial-of-service possibility in logout() view by filling session store

    The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attacker…

  • High 7.5

    Django denial of service via empty session record creation

    contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a …

  • High —

    Improper Authentication in Apache WSS4J

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an una…

  • High 7.0

    Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-O…