371 matches found
Stream HTTP wrapper truncates redirect location to 1024 bytes
...
CVE-2025-30742
The CVE-2025-30742 entry concerns atophttpd 2.8.0. Affected component: httpd.c. Description: an off-by-one error causes an out-of-bounds read when processing a 1024-character request string that would not terminate with a final NUL character. Impact is a partial/low-severity in the NVD metrics (a...
CVE-2025-30742
httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' character...
CVE-2025-1024
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting XSS in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to...
CVE-2025-1024 Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting XSS in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to...
CVE-2025-1024 Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting XSS in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to...
PT-2025-23647 · Crates.Io · Users
Affected versions append root to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege...
CVE-2024-45008
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...
AZL-34735 CVE-2023-6246 affecting package glibc for versions less than 2.38-6
A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name the basename of...
CVE-2024-1024
creationtimestamp| type| source ---|---|--- 2024-01-30 02:31:16+00:00| seen| https://t.me/ctinow/175658 2024-02-21 14:06:55+00:00| seen| https://t.me/ctinow/189595...
CVE-2024-1024
CVE-2024-1024 affects SourceCodester Facebook News Feed Like 1.0, specifically the New Account Handler component. The vulnerability is a cross-site scripting flaw triggered by unvalidated input in the First Name/Last Name field (example payload: ), allowing remote initiation. Multiple sources cor...
Rocky Linux 8 : openssl (RLSA-2021:1024)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1024 advisory. - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello...
Why We Don’t Generate Elliptic Curves Every Day
With all the talk recently of how the NIST curve parameters were selected, a reasonable observer could wonder why we all use the same curves instead of generating them along with keys, like we do for Diffie-Hellman parameters. You might have memories of waiting around for openssl dhparam to run a...
CVE-2023-1024
creationtimestamp| type| source ---|---|--- 2023-02-28 16:29:24+00:00| seen| https://t.me/cibsecurity/59097...
CVE-2023-1024
The CVE-2023-1024 entry concerns the WP Meta SEO WordPress plugin, where a missing capability check in regenerateSitemaps (versions up to 4.5.3) allows authenticated subscribers to generate sitemaps. Root cause: reliance on nonce-based access control, with nonces exposed to all authenticated user...
U.S. Dept Of Defense: HAProxy stats panel exposed externally
An exposed web panel for HAProxy running on a system allowed external access to the statistics page at port 1024, potentially exposing sensitive information...
CVE-2017-1024
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none...
K20281756: Libgcrypt vulnerability CVE-2017-7526
Security Advisory Description libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately mo...
K16674: TLS vulnerability CVE-2015-4000
Security Advisory Description The TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE...
SUSE CVE-2011-1024
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicyforwardupdates aka authentication-failure forwarding is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a sla...