5129 matches found
ROS-20240410-06
The vulnerability in the Sudo system administration program is related to a flaw in the mechanism for encoding or or shielding of output data. Exploitation of the vulnerability allows an attacker acting remotely gain access to sensitive data...
ROS-20240410-17
The vulnerability of the ImageBuild function of the Moby containerization software tool is related to a flaw in the data source validation mechanism for endpoint processing. is related to a flaw in the data source validation mechanism for endpoint processing. Exploitation of the vulnerability cou...
CVE-2024-30688
CVE-2024-30688 is rejected/not used and does not represent an active vulnerability entry.
CVE-2024-31813
TOTOLINK EX200 V4.0.3c.7646B20201211 does not contain an authentication mechanism by default...
CVE-2024-31813
TOTOLINK EX200 V4.0.3c.7646B20201211 does not contain an authentication mechanism by default...
CVE-2024-31813
TOTOLINK EX200 V4.0.3c.7646B20201211 does not contain an authentication mechanism by default...
HTTP/2 CONTINUATION Flood Vulnerability
HTTP/2, a widely adopted web communication protocol, organizes data transmission through a binary framing layer, wherein all communication is divided into smaller messages called frames, each identified by a specific type, such as headers, data, and continuation frames. HTTP/2 HEADER frames...
undertow: unrestricted request storage leads to memory exhaustion
A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...
VMware SD-WAN Edge and SD-WAN Orchestrator updates address multiple security vulnerabilities.
3a. Unauthenticated Command Injection vulnerability in SD-WAN Edge CVE-2024-22246 VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. VMware has evaluated the severity of this issue to be in the Important severity range with...
ROS-20240402-02
A vulnerability in the CRI-O container mechanism is related to experimental annotation, causing the the container becomes unrestricted. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
TikTok: Account Takeover via Authentication Bypass in TikTok Account Recovery
An improper authentication mechanism in TikTok's account recovery process was identified. The vulnerability was reported and has been completely fixed. There was no evidence of exploitation...
ROS-20240401-03
A vulnerability in the CRI-O container mechanism is related to adding arbitrary lines to /etc/passwd using a a specially crafted environment variable. Exploitation of the vulnerability could allow an attacker acting remotely to affect the confidentiality, integrity, and availability of the CRI-O...
BIT-ARGO-CD-2024-21662 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combine...
Incorrect Authorization
ZITADEL is vulnerable to Incorrect Authorization. The vulnerability is due to certain actions being able to set reserved claims managed by ZITADEL, such as urn:zitadel:iam:user:resourceowner:name. To address this, a protection mechanism has been introduced to prevent actions from altering claims...
URL Protocol Bypass
katex is vulnerable to URL Protocol Bypass. The vulnerability is due to insufficient validation of URL protocols by the KaTeX library's trust option. It allows malicious inputs containing URLs with uppercase characters in the protocol to bypass the blacklist mechanism...
ROS-20240328-17
The vulnerability in the Sudo system administration program is related to a flaw in the mechanism for encoding or or shielding of output data. Exploitation of the vulnerability allows an attacker acting remotely gain access to sensitive data...
Improper Restriction Of Excessive Authentication Attempts
github.com/argoproj/argo-cd/ is vulnerable to Improper Restriction Of Excessive Authentication Attempts. This vulnerability is due to a weak cache-based mechanism that allows attackers to bypass rate limit and brute force protections, which can result in account compromise...
GO-2024-2652 Brute force protection bypass in github.com/argoproj/argo-cd/v2
An attacker can effectively bypass the rate limit and brute force protections in Argo CD by exploiting the application's weak cache-based mechanism. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. An attacker can overflow this cache b...