CVE-2024-38523

Hush Line vulnerability CVE-2024-38523 affects the Hush Line OTP flow. The issue is a lack of 2FA for changing security settings, enabling an attacker using CSRF or XSS primitives to alter settings without user interaction and credentials being required. The problem is mitigated in version 0.10. ...

CVE-2024-38523 Hush Line OTP issue

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

Net-IPv4Addr Security Vulnerability

Net-IPv4Addr is an open source Perl module from metacpan for working with IPv4 addresses. A security vulnerability exists in Net-IPv4Addr version 0.10 that stems from not properly filtering IP address strings that begin with 0, allowing an attacker to bypass IP address-based access control...

PT-2024-11203 · Unknown +1 · Net::Ipv4Addr +1

Name of the Vulnerable Software and Affected Versions: Net::IPV4Addr module version 0.10 for Perl Description: The issue arises from the Net::IPV4Addr module's improper handling of extraneous zero characters in IP address strings. This can lead to the bypassing of access control mechanisms that...

SUSE CVE-2013-4450

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service memory and CPU consumption by sending a large number of pipelined requests without reading the response...

SUSE CVE-2016-2839

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo cairosurfacegetextents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service application crash via a crafted video...

SUSE CVE-2016-9447

The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service out-of-bounds read or write and possibly execute arbitrary code via a crafted NSF music file...

SUSE CVE-2020-21827

A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read2004compressedsection ../../src/decode.c:2379...

SUSE CVE-2020-21833

A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read2004sectionclasses ../../src/decode.c:2440...

SUSE CVE-2020-21831

A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read2004sectionhandles ../../src/decode.c:2637...

SUSE CVE-2020-21835

A null pointer deference issue exists in GNU LibreDWG 0.10 via read2004compressedsection ../../src/decode.c:2337...

SUSE CVE-2020-21843

A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bitreadRC ../../src/bits.c:318...

SUSE CVE-2020-21841

A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bitreadB ../../src/bits.c:135...

SUSE CVE-2020-21840

A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bitsearchsentinel ../../src/bits.c:1985...

WordPress plugin Amazon JS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Amazon JS <= 0.10 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC amazonjs asin='XSS' imgsize='"...

Kaitai Struct: compiler vulnerable to denial-of-service (DoS)

Overview Kaitai Struct: compiler provided by Kaitai team contains SnakeYAML library version 1.25, which is used in parsing .ksy files. SnakeYAML version 1.25 expands recursive aliases unlimitedly CWE-674, hence Katai Struct: compiler is vulnerable to a denial-of-service DoS attack by Billion Laug...

DEBIAN-CVE-2022-29788

libmobi before v0.10 contains a NULL pointer dereference via the component mobibuffergetpointer. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted mobi file...

Bottle does not properly limit content-types

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; semi-colon and a Content-Type that would not be accepted, as...

Edgewall Trac Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors...