8269 matches found
Security Bulletin: IBM Switches flood Fibre Channel-over-Ethernet (FCoE) data frame out of every port if destination address is not in MAC table (CVE-2013-0570)
Abstract IBM System Networking switches that are capable of Fibre Channel over Ethernet FCoE will flood FCoE data frames with unknown MAC addresses to all ports on the switch. Remediation for this vulnerability consists of updating the IBM Networking Operating System NOS running on these switches...
Mozilla: Data-race when parsing non-UTF-8 URLs in threads
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...
Mozilla: Data-race when parsing non-UTF-8 URLs in threads
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...
A mistake made by the Minters can result in minting tokens to a wrong address or a zero address.
Lines of code Vulnerability details Impact Tokens can be minted to a wrong address. Proof of Concept The function mintermint is used by the Minters, to mint tokens to the users that successfully used the functions submitAndDeposit, submit and submitAndGive. However there is no check in mintermint...
An attacker taking over the timelock_address or the owner address will result in DoS and unusable contract (frxETHMinter).
Lines of code Vulnerability details Impact Actions described in the POC result in DoS, if an attacker takes over one of the two "admin" addresses. Proof of Concept By taking over the timeLock or the owner address, the attacker will have access to the following functions moveWithheldETH,...
Jenkins extreme-feedback Plugin vulnerable to Missing Authorization
Jenkins extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps. As of publicati...
GHSA-MRF6-4GW6-65V3 Jenkins extreme-feedback Plugin vulnerable to Missing Authorization
Jenkins extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps. As of publicati...
CVE-2022-41242
A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps...
CVE-2022-41242
A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps...
Record DDoS Attack with 25.3 Billion Requests Abused HTTP/2 Multiplexing
Cybersecurity company Imperva has disclosed that it mitigated a distributed denial-of-service DDoS attack with a total of over 25.3 billion requests on June 27, 2022. The "strong attack," which targeted an unnamed Chinese telecommunications company, is said to have lasted for four hours and peake...
Jenkins extreme-feedback Plugin å®å Øę¼ę“
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
nodejs-normalize-url: ReDoS for data URLs
A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...
CVE-2022-40429
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...
PYSEC-2022-43107
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...
PYSEC-2022-43115
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...
PYSEC-2022-43107
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...
d8s-dates (=0.1.0), d8s-dicts (=0.1.0) +5 more potentially affected by unknown CVE via democritus-hypothesis (=2021.1.2101)
democritus-hypothesis PYPI version =2021.1.2101 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-hypothesis and may be impacted: - d8s-dates =0.1.0 - d8s-dicts =0.1.0 - d8s-domains =0.1.0 - d8s-ip-addresses =0.1.0 - d8s-strings =0.1.0 -...
d8s-asns (=0.1.0), d8s-domains (=0.1.0) +8 more potentially affected by unknown CVE via democritus-json (=2021.1.2501)
democritus-json PYPI version =2021.1.2501 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-json and may be impacted: - d8s-asns =0.1.0 - d8s-domains =0.1.0 - d8s-html =0.1.0 - d8s-ip-addresses =0.1.0 - d8s-mpeg =0.1.0 - d8s-networking =0.1.0 ...
d8s-asns (=0.1.0), d8s-domains (=0.1.0) +6 more potentially affected by unknown CVE via democritus-networking (=2023.1.22)
democritus-networking PYPI version =2023.1.22 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-networking and may be impacted: - d8s-asns =0.1.0 - d8s-domains =0.1.0 - d8s-html =0.1.0 - d8s-ip-addresses =0.1.0 - d8s-mpeg =0.1.0 - d8s-pdfs...
CVE-2022-40429
CVE-2022-40429 affects the Python package d8s-ip-addresses (version 0.1.0) distributed on PyPI. A third-party backdoor named democritus-networking was inserted, enabling potential code execution. Descriptions across multiple sources confirm the root cause is a tainted package supply chain, leadin...