GHSA-H8G9-6GVH-5MRC etcd vulnerable to TOCTOU of gateway endpoint authentication

Vulnerability type Authentication Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates th...

PT-2022-28253 · Etcd · Etcd

Name of the Vulnerable Software and Affected Versions: etcd affected versions not specified Description: The issue is related to authentication in the etcd gateway. It only authenticates endpoints detected from DNS SRV records and does so only once. If an endpoint changes its authentication...

AlgebraPoolDeployer.sol#L50-L51 : After the pool deployment, the memory of "parameters's" members are not cleaned.

Lines of code Vulnerability details Impact As the memory of previous members are not cleared, this can cause unexpected result when deploying subsequent pools. Proof of Concept. parameters = ParametersdataStorage: dataStorage, factory: factory, token0: token0, token1: token1; pool = addressnew...

isolated-vm has vulnerable CachedDataOptions in API

Impact If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user...

GHSA-2JJQ-X548-RHPV isolated-vm has vulnerable CachedDataOptions in API

Impact If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user...

PT-2022-24856 · Unknown · Isolated-Vm

Name of the Vulnerable Software and Affected Versions: isolated-vm versions 4.3.6 and prior Description: The issue allows attackers to bypass the sandbox and run arbitrary code in the nodejs process if untrusted v8 cached data is passed to the API through CachedDataOptions. This can be exploited ...

camospace.com Cross Site Scripting vulnerability OBB-2959356

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Authorization

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to stea...

CVE-2022-39258 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to stea...

PT-2022-24850 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow versions prior to 2022-09 Description: A vulnerability in mailcow allows an attacker to craft a custom Swagger API template to spoof Authorize links, potentially redirecting a victim to an attacker-controlled place to steal Swagger...

Using non cleaned up variables inside of inline assembly

Lines of code Vulnerability details Impact There is a revealGobblers function in a ArtGobblers smart contract. Inside the function is an assembly insert, which operates with a variable with a size less than a machine word. But the code inside the assembly not checking that variable is cleaned up...

Security Bulletin: IBM Operational Decision Manager and JRules Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: InfoSphere MashupHub Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. InfoSphere MashupHub ships javadoc files in it's install tree. If these files are made accessible from the internet this vulnerability could be exploited. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTM...

Security Bulletin: Storwize V7000 Unified documentation update available for configuration of Storwize V7000 Unified with LDAP authentication (CVE-2012-0706)

Abstract Storwize V7000 Unified includes a version of the LDAP client which stores the username and the password of the LDAP user in clear text in the local file system. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0706 DESCRIPTION: Storwize V7000 Unified requires LDAP username called binddn a...

Security Bulletin: SONAS documentation update available for configuration of SONAS with LDAP authentication (CVE-2012-0706)

Abstract SONAS includes a version of the LDAP client which stores the username and the password of the LDAP user in clear text in the local file system. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0706 DESCRIPTION: SONAS requires LDAP username called binddn and password for authentication...

Security Bulletin: IBM InfoSphere Streams Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. InfoSphere Streams ships javadoc files in it's install tree. If these files are made accessible from the internet this vulnerability could be exploited. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML...

Security Bulletin: IBM Sterling Order Management - Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: InfoSphere Guardium Data Redaction Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Sterling External Authentication Server Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: TADDM Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...