CVE-2019-15929

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

No affected versions have been published.

Timeline

Published
Oct 24, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-15937.8A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their priCVE-2019-159304.3Intesync Solismed 3.3sp allows Clickjacking.CVE-2019-159319.8Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246.CVE-2019-159329.8Intesync Solismed 3.3sp has Incorrect Access Control.CVE-2019-159339.8Intesync Solismed 3.3sp has SQL Injection.CVE-2019-159348.8Intesync Solismed 3.3sp has CSRF.CVE-2019-159356.1Intesync Solismed 3.3sp has XSS.CVE-2019-159369.8Intesync Solismed 3.3sp allows Insecure File Upload.CVE-2019-159379.8Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly useCVE-2019-159389.8Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used fCVE-2019-159395.9An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hoCVE-2019-15947.4A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of