Timing Attack

github.com/answerdev/answer is vulnerable to Timing Attacks. The vulnerability exists because the application does not have a constant login attempt response time. which allows an attacker to brute force valid account email addresses...

CVE-2023-2754

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses...

CVE-2023-2754

The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses...

CVE-2023-37559

After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

Information disclosure

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

PT-2023-21198 · Cloudflare · Cloudflare Warp Client For Windows

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP client for Windows affected versions not specified Description: The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, as it acts as a local DNS server that performs DNS queries in a secure...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

PT-2023-25535 · I2P · I2P

Name of the Vulnerable Software and Affected Versions: i2p versions prior to 2.3.0 Description: The issue allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services aka eepsites via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed...

CVE-2023-3345 LMS by Masteriyo < 1.6.8 - Information Exposure

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students...

PT-2023-24346 · Masteriyo · The Lms By Masteriyo

Name of the Vulnerable Software and Affected Versions: The LMS by Masteriyo WordPress plugin versions prior to 1.6.8 Description: The issue concerns improper authorization in some of the plugin's REST API endpoints. This allows any students to retrieve email addresses of other students, effective...

WordPress plugin LMS by Masteriyo 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

Artemis - APK Infrastructure Investigator

Overview A tools for Find APK Infrastructure . HADESS performs offensive cybersecurity services through infrastructures and software that include vulnerability analysis, scenario attack planning, and implementation of custom integrated preventive projects. We organized our activities around the...

Apache NiFi 代码注入漏洞

Apache NiFi is an open source tool for building reliable and secure data pipelines. It supports collecting, aggregating and transferring data from a variety of sources and provides powerful data processing and transformation capabilities. A remote code execution vulnerability exists in Apache NiF...

Unrestricted Access to setRoyalty Function

Lines of code Vulnerability details Impact Severity: High Likelihood: High Description The setRoyalty function in the ERC2981CollectionRoyalties contract can be called by anyone. This function is used to set the royalty information for a specific token ID. However, because there are no access...

Netdisco 输入验证错误漏洞

Netdisco is a web-based network management tool. A security vulnerability exists in versions prior to Netdisco v2.063000, which stems from an open redirection vulnerability in Netdisco. An attacker can exploit this vulnerability by constructing specially crafted links to redirect users to arbitra...

Double Free

gpac is vulnerable to Double Free. The vulnerability exists in gfav1resetstate within mediatools/avparsers.c which calls free twice on the same memory address which could lead to manipulation of memory locations resulting in a memory leak...