CVE-2023-28972

CVE-2023-28972 affects Juniper Networks Junos OS on NFX Series. The vulnerability is caused by an improper link resolution before file access in console port access, allowing an attacker with physical console access to bypass login controls and change the root password via set system root-authent...

CVE-2023-29018

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on open-feature-operator-controller-manager to escalate the privileges o...

Security Bulletin: Vulnerabilities in Samba shipped with IBM OS Image for Red Hat Enterprise Linux System (CVE-2022-32742)

Summary Vulnerabilities have been found in Samba shipped with IBM OS Image for Red Hat Enterprise Linux System Vulnerability Details CVEID:CVE-2022-32742 DESCRIPTION: Samba could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak when handling SMB1...

CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege Escalation

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on open-feature-operator-controller-manager to escalate the privileges o...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM BladeCenter Switches (CVE-2015-7575)

Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Switches. Vulnerability Details Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Switches. Vulnerability Details CVE-ID: CVE-2015-7575 Description: The TLS protocol could allow weaker than expected...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM BladeCenter Advanced Management Module (AMM) (CVE-2015-7575)

Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Advanced Management Module AMM. Vulnerability Details Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Advanced Management Module AMM. Vulnerability Details CVE-ID: CVE-2015-7575 Description: The TLS...

Security Bulletin: Vulnerability in SSLv3 affects IBM BladeCenter Advanced Management Module (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. Vulnerability Details Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter S SAS RAID Module Firmware (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah Attack" for SSL/TLS affects IBM BladeCenter S SAS RAID Module Firmware. Vulnerability Details Summary The RC4 "Bar Mitzvah Attack" for SSL/TLS affects IBM BladeCenter S SAS RAID Module Firmware. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4...

Security Bulletin: Vulnerability in cURL affects IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in cURL. Vulnerability Details Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in cURL. Vulnerability Details CVEID: CVE-2017-1000254 Description:...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter Switches (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Switches. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Switches. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and S...

PT-2023-22422 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: The issue is related to multiple command injection vulnerabilities. These vulnerabilities can be exploited via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function...

ETHCrowdfundBase._finalize() calculates the total voting power wrongly.

Lines of code Vulnerability details Impact After the crowdfund is finalized, the party wouldn't work properly because total voting power is greater than the sum of all voters' voting power. In the worst case, any proposal including the distribution one wouldn't be executed because it doesn't meet...

MaxContribution check can be bypassed to give a card high voting power

Lines of code Vulnerability details Proof of Concept ReraiseETHCrowdfund tries limit the voting power of each card by doing a min/maxContribution check in claim and claimMultiple. uint96 contribution = votingPower 1e4 / exchangeRateBps; uint96 maxContribution = maxContribution; // Check that the...

VetoProposal#voteToVeto can be called repeatedly by same voter and be used to lock party

Lines of code Vulnerability details Impact Party can be locked due to not being able to pass and proposals Proof of Concept VetoProposal.solL37-L59 uint96 votingPower = party.getVotingPowerAt msg.sender, proposalValues.proposedTime - 1, snapIndex ; uint96 newVotes = votes + votingPower; // Check ...

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.25 is vulnerable to Cross Site Scripting (XSS)

Software ShiftController Employee Shift Scheduling Type Plugin Vulnerable versions = 4.9.25 Fixed in 4.9.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1978 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID dde7717ec078...

OperatorProposal._executeOperation() should refund excess ETH

Lines of code Vulnerability details Impact There are excess ETH in OperatorProposal.executeOperation, and it should be refunded. Proof of Concept OperatorProposal.executeOperation runs data.operator.execute with data.operatorValue of ETH. data.operator.execute value: data.operatorValue...

WordPress MyCryptoCheckout Plugin < 2.124 is vulnerable to Cross Site Scripting (XSS)

Software MyCryptoCheckout Type Plugin Vulnerable versions 2.124 Fixed in 2.124 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1546 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b58e27663e61 Credits Pablo Sanchez Required...

InitialETHCrowdfund.batchContributeFor() doesn't refund for failed contributes

Lines of code Vulnerability details Impact InitialETHCrowdfund.batchContributeFor doesn't refund for failed contributes when args.revertOnFailure is false. The funds will be locked in the initial crowdfund contract, so it should be refunded. Proof of Concept InitialETHCrowdfund.batchContributeFor...

ReraiseETHCrowdfund#claimMultiple can be used to grief large depositors

Lines of code Vulnerability details Impact User can be grieved by being force minted a large number of NFTs with low voting power instead of one with high voting power Proof of Concept ReraiseETHCrowdfund.solL354-L377 for uint256 i; i maxContribution revert...

Contributions can be smaller than minContribution and may receive no voting power

Lines of code Vulnerability details Impact Valid contribution is awarded no voting power Proof of Concept ETHCrowdfundBase.solL195-L219 uint96 minContribution = minContribution; if amount maxContribution revert AboveMaximumContributionsErroramount, maxContribution; uint96 newTotalContributions =...