Lucene search
+L

3656 matches found

SUSE CVE
SUSE CVE
added 2023/02/15 3:51 a.m.6 views

SUSE CVE-2020-35518

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database...

5.3CVSS6.6AI score0.01538EPSS
SaveExploits0References6
SUSE CVE
SUSE CVE
added 2023/02/15 3:49 a.m.12 views

SUSE CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

4.4CVSS6.7AI score0.00321EPSS
SaveExploits0References6
SUSE CVE
SUSE CVE
added 2023/02/15 3:39 a.m.8 views

SUSE CVE-2021-37659

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting e.g., gradients of binary cwise operations. The implementatio...

7.8CVSS5.6AI score0.00176EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2023/02/15 3:37 a.m.8 views

SUSE CVE-2021-41219

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

7.8CVSS7.5AI score0.00211EPSS
SaveExploits1References3
SUSE CVE
SUSE CVE
added 2023/02/15 3:28 a.m.18 views

SUSE CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

9.8CVSS8.6AI score0.99638EPSS
SaveExploits105References3
SUSE CVE
SUSE CVE
added 2023/02/15 3:27 a.m.11 views

SUSE CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

5.9CVSS7.8AI score0.03472EPSS
SaveExploits1References15
SUSE CVE
SUSE CVE
added 2023/02/15 3:25 a.m.8 views

SUSE CVE-2022-31799

Bottle before 0.12.20 mishandles errors during early request binding...

7.5CVSS7AI score0.02053EPSS
SaveExploits0References4
OSV
OSV
added 2023/02/09 7:15 p.m.14 views

CVE-2023-21422

Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding WifiService...

5.5CVSS6.1AI score0.0015EPSS
SaveExploits0References1
Veracode
Veracode
added 2023/01/27 3:54 a.m.34 views

Privilege Escalation

github.com/rancher/rancher is vulnerable to Privilege Escalation. The vulnerability exists due to a flaw in the authorization logic, which allows an attacker to escalate permissions for any -promoted resource in any cluster through the project role template binding PRTB and -promoted roles...

8.8CVSS8.3AI score0.00677EPSS
SaveExploits1References6Affected Software1
CISA
CISA
added 2023/01/26 12:00 a.m.40 views

CISA Has Added One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. This type of vulnerability is a frequent attack vector for malicious cyber actors and poses a significant risk to the federal enterprise. Note: To view the newly added...

1.7AI score
SaveExploits0References5
OSV
OSV
added 2023/01/25 7:35 p.m.97 views

GHSA-7M72-MH5R-6J3R Privilege escalation in project role template binding (PRTB) and -promoted roles

Impact An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding PRTB and -promoted roles. This issue is not present in Rancher 2.7...

7.2CVSS7.7AI score0.00677EPSS
SaveExploits1References4
Github Security Blog
Github Security Blog
added 2023/01/25 7:35 p.m.53 views

Privilege escalation in project role template binding (PRTB) and -promoted roles

Impact An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding PRTB and -promoted roles. This issue is not present in Rancher 2.7...

8.8CVSS8.1AI score0.00677EPSS
SaveExploits1References4Affected Software1
Citrix
Citrix
added 2023/01/19 12:00 a.m.16 views

Internal WPF code tried to reactive a bindingexpression that was already marked as detached

When upgrading VDA to 2203 Cu2, you may receive an error stating "Internal error: Internal WPF code tried to reactive a bindingexpression that was already marked as detached"...

7.2AI score
SaveExploits0
OSV
OSV
added 2023/01/18 6:06 p.m.25 views

GO-2023-1268 Authentication failure in mellium.im/sasl

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2023/01/17 12:00 a.m.8 views

PT-2023-34403 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.163 Description: The issue is related to the handling of network packets, specifically the association of a socket buffer skb with a device during transmission tx. The actual impact and potential for attac...

7.4AI score
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2023/01/12 9:59 p.m.59 views

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a data binding rules security weakness in Spring Framework (CVE-2022-22968)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a Spring framework data binding rules vulnerability, where case sensitive patterns for disallowedFields cause weaker than expected security CVE-2022-22968. Spring Framework is used by some of the java...

5.3CVSS5.6AI score0.05666EPSS
SaveExploits2Affected Software1
Veracode
Veracode
added 2023/01/10 7:21 a.m.37 views

Authentication Bypass

github.com/mellium/sasl is vulnerable to authentication bypass. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty causing authentication to fail in the best case, which may lead to...

9.8CVSS9.1AI score0.0089EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2022/12/31 3:30 a.m.46 views

mellium.im/sasl authentication failure due to insufficient nonce randomness

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9AI score0.0089EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2022/12/31 3:30 a.m.81 views

GHSA-GVFJ-FXX3-J323 mellium.im/sasl authentication failure due to insufficient nonce randomness

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS9.4AI score0.0089EPSS
SaveExploits0References6
OSV
OSV
added 2022/12/31 1:15 a.m.14 views

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...

9.8CVSS5.8AI score0.0089EPSS
SaveExploits0References1
Rows per page
Query Builder