PSF-2023-10 DoS when reading malformed Apple Property List files in binary format

readints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format...

TP-LINK TL-WR941ND 安全漏洞

The TP-LINK TL-WR941ND is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-Link Routers that originates from a buffer overflow vulnerability in component /userRpm/AccessCtrlAccessRulesRpm. An attacker could exploit the vulnerability to cause a denial of service DoS ...

CVE-2023-39741

lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::writeint function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

RHEL 9 : .NET 6.0 (RHSA-2023:4639)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4639 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

CVE-2023-32565

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

CVE-2023-32566

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

Design/Logic Flaw

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

CVE-2023-32566

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

CVE-2023-32566

Ivanti Avalanche earlier than 6.4.1.207 contains CVE-2023-32566, an authentication bypass in SecureFilter allowPassThrough (affecting components such as WLAvalancheService.exe). The underlying issue is an auth bypass vulnerability that could allow unauthorized access; Ivanti notes fixed in 6.4.1....

SecurityCouncilMemberSyncAction : perform function can be continually DOSed which will prevent the valid update the members of the gnosis safe

Lines of code Vulnerability details Impact The securityCouncil update will be prevented by continuously calling the perform function. Since the function rely on the nonce value, this function can be continuously called and nonce value is updated. This would prevent the valid security council upda...

PT-2023-26724 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A Cross-Site Request Forgery CSRF issue in the System Halt API at the "/system/halt" endpoint allows attackers to cause a Denial...

CVE-2023-38999

A Cross-Site Request Forgery CSRF in the System Halt API /system/halt of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service DoS via a crafted GET request...

SUSE-SU-2023:3245-1 Security update for keylime

This update for keylime fixes the following issues: - CVE-2023-38200: Fixed a DoS attack against it's SSL connections. bsc1213310...

Anyone can complete the Rng relay auction

Lines of code Vulnerability details Impact There's no access restriction on rngComplete which allows anyone to execute this function and complete the auction. This can lead to unexpected behavior or potential DOS attack where a user completes the auction. Tools Used Manual Analysis Recommended...

RngRelayAuction.rngComplete() DOS attack

Lines of code Vulnerability details Impact If the recipient maliciously enters the blacklist of priceToken, it may cause rngComplete to fail to execute successfully Proof of Concept The current implementation of RngRelayAuction.rngComplete immediately transfers the prizeToken to the recipient...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles large repositories. An attacker can exploit this vulnerability to cause GitLab to exhaust its memory resources, resulting in a denial of service...

PT-2023-9782 · Mitsubishi · Got2000 Series +1

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS21 model versions 01.49.000 and prior Description: The issue is related to a Predictable Exact Value fr...

Design/Logic Flaw

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

Denial Of Service (DoS)

neutron is vulnerable to Denial of Service. The vulnerability exists because resources are produced without regard to the user's quota, which allow an attacker to submit a large number of requests, causing the application to crash...

PT-2023-3902 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.27.0 Envoy versions prior to 1.26.4 Envoy versions prior to 1.25.9 Envoy versions prior to 1.24.10 Envoy versions prior to 1.23.12 Description: The issue is related to a use-after-free error in the HTTP CORS filter o...