Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 13:10:12 +0000 CVE-2023-25156 — Kiwi TCMS has no protection against brute-force attacks on login page https://vulnerability.circl.lu/vuln/cve-2023-25156 <p><strong>Affected:</strong> kiwitcms kiwi</p> <p>Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.</p> <p><strong>Affected:</strong> kiwitcms kiwi</p> <p>Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.</p> https://vulnerability.circl.lu/vuln/cve-2023-25156 GHSA-7968-h4m4-ghm9 — No protection against brute-force attacks on login page https://vulnerability.circl.lu/vuln/ghsa-7968-h4m4-ghm9 <p><strong>Affected:</strong> PyPI: kiwitcms</p> <p>### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.</p> <p>### Patches Users should upgrade to v12.0 or later.</p> <p>### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.</p> <p>### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)</p> <p><strong>Affected:</strong> PyPI: kiwitcms</p> <p>### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.</p> <p>### Patches Users should upgrade to v12.0 or later.</p> <p>### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.</p> <p>### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)</p> https://vulnerability.circl.lu/vuln/ghsa-7968-h4m4-ghm9