Unbounded number of Collateral

Handle gzeon Vulnerability details Impact Each additional collateral will increase gas required for many operations, e.g. Liquidation. If there are too many collateral it may exceed the block gas limit. Proof of Concept Recommended Mitigation Steps Define a max number of collateral asset --- The...

CVE-2021-43987

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface...

GSD-2021-1002513 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.85 by commit...

GSD-2021-1002460 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.165 by commit...

GSD-2021-1002429 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.221 by commit...

GSD-2021-1002407 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.258 by commit...

GSD-2021-1002366 ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Limit the period size to 16MB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.295 by commit...

PT-2021-26834

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.4.295 Description: The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2021-27065

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.8 Description The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

PT-2021-26851

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.293 Description The issue is related to the ALSA pcm oss component, where the period size is limited to 16MB. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

NumPy 缓冲区错误漏洞

NumPy is a Python scientific computing package. NumPy version 1.9 is vulnerable to a buffer overflow vulnerability caused by the lack of a limit on array length in the PyArrayNewFromDescrint function in ctor .c, which leads to a buffer overflow vulnerability that can be exploited to cause a denia...

plasson-pead.com.br Cross Site Scripting vulnerability OBB-2304264

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

Reddit: No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com

Summary: i found brute force on gateway-production.dubsmash.com . find valid usersnames and emails no rate limit Impact: attacker could collect all usernames and valid emails through brute force on forget password Steps To Reproduce: open gateway-production.dubsmash.com and forget email and enter...

Suggestion : To add explicit check for no of epochs to be 255 in createPromotion and extendPromotion

Handle 0x421f Vulnerability details So we are using uint256 to store 1/0 if that epoch is being claimed or not uint2561 is our base, so 255 is max limit we have now if someone creates a promotion with 255 epochs in epochs 255 , it will revert with "TypeError : Invalid Rational Number" Copied from...

CVE-2021-37934

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing...

Default credentials

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...