gRPC-Go HTTP/2 Rapid Reset vulnerability

Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit...

GHSA-M425-MQ94-257G gRPC-Go HTTP/2 Rapid Reset vulnerability

Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

Code injection

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

CLSA-2023-1698247974 Fix of 6 CVEs

CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752 - igmp: limit igmpv3newpack packet size to IPMAXMTU CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623 - net/sched: schhfsc: Ensure inner classes have fsc curve CVE-2023-34319 // CVE-url:...

surplusTransferPercentage will always be less than 1%

Lines of code Vulnerability details Impact The protocol has a feature to auction the surplus amount and send some % out of that to extraSurplusReceiver but currently this % always less than 1% which limits the amount extraSurplusReceiver can get out of the surplus Proof of Concept we believe this...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' due to improper hashid limitation. This results in the application spending a significant amount of time decoding the ID and allocating a large amount of memory. Details Denial of...

PT-2023-22498 · Unknown · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Pfsense CE version 2.6.0 Description: The issue is related to the absence of a rate limit, which can be exploited by an attacker to create multiple malicious users in the firewall. This can lead to potential security breaches. Recommendations...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

PT-2023-32940

Name of the Vulnerable Software and Affected Versions encoded id-rails versions before 1.0.0.beta2 Description The issue is an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an...

CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall...

ROS-20231024-03

The OAuth2 token vulnerability of the cloud-based software for creating and utilizing Nextcloud storage Nextcloud data storage software is related to the storage of OAuth2 tokens in plaintext. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to the server a...

CLSA-2023-1698101447 nginx: Fix of CVE-2023-44487

CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...

nginx: Fix of CVE-2023-44487

CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...

DEBIAN-CVE-2023-45678

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in startdecoder because at maximum m-submaps can be 16 but submapfloor and submapresidue are declared as arrays of 15 elements. This issue may lead to code execution...

stb_vorbis buffer error vulnerability

stbvorbis is an open source audio decoder for decoding ogg vorbis files. A security vulnerability exists in stbvorbis, which stems from the fact that a carefully crafted file may trigger a buffer write in "startdecoder", because "m-submaps" can be at most 16, but "submapfloor" and "submapresidue"...

CLSA-2023-1697817547 nginx: Fix of CVE-2023-44487

CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...

CVE-2023-4668

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins present and active, active theme,...