CVE-2024-38523 Hush Line OTP issue

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

CVE-2024-38523 Hush Line OTP issue

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

Exploit for Use of Password Hash With Insufficient Computational Effort in Fortinet Fortiproxy

FortiOS and FortiProxy Password Hashing Vulnerability to RCE...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

PT-2024-28051

Name of the Vulnerable Software and Affected Versions Hush Line versions prior to 0.10 Description The issue concerns the TOTP authentication flow in Hush Line, which has multiple weaknesses that undermine its one-time nature. Specifically, the lack of 2FA for changing security settings allows an...

CVE-2024-38523: Improper Authentication

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

ROS-20240626-14

Vulnerability of REFRESH MATERIALIZED VIEW CONCURRENTLY function of PostgreSQL database management system is related to privilege management errors in processing and checking command line parameters. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary SQ...

Malicious code in Stl.CommandLine.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2612 Malicious code in line-configs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in line-configs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in historic-rates-line-chart (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2479 Malicious code in historic-rates-line-chart (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2325 Malicious code in eslint-disable-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4badfe1d87068f4cc3cb6bd441258d5caebd50c951f1e4c1ec43729eb79a08d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-disable-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4badfe1d87068f4cc3cb6bd441258d5caebd50c951f1e4c1ec43729eb79a08d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

ZenML is vulnerable to a Denial Of Service DoS. The vulnerability is due to improper handling of line feed \n characters in component names, allowing an attacker to cause uncontrolled resource consumption by adding a component through an API endpoint api/v1/workspaces/default/components...

PT-2024-6532 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.4R3 through 21.4R3-S5 Junos OS versions 22.1R3 through 22.1R3-S4 Junos OS versions 22.2R2 through 22.2R3 Junos OS versions 22.3R1 through 22.3R2-S2, 22.3R3 Junos OS versions 22.4R1 through 22.4R2 Description: An Improper...

Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

LINE client for iOS vulnerable to universal cross-site scripting

Overview The in-app browser of LINE client for iOS provided by LY Corporation contains a universal cross-site scripting vulnerability CWE-79, CVE-2024-5739. LY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact If a user clicks a malicious...

PT-2024-31195

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3 Description A denial of service issue exists due to improper handling of line feed characters in component names. When a low-privileged user adds a component through the API endpoint...

Cisco Crosswork Network Services Orchestrator Privilege Escalation

The vulnerability of the command-line interface CLI of the Cisco Crosswork Network Services Orchestrator software environment relates to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root user by sending a specially...