Timing Attack

generator-jhipster is vulnerable to a Timing Attack. The vulnerability exists because the TokenProvider.java uses String.equalsstr to compare the given token-signature. This comparison method does not effectively validate the token because it stops as soon as it encounters the first character tha...

CVE-2018-19410

creationtimestamp| type| source ---|---|--- 2023-08-13 04:23:57+00:00| seen| Telegram/tHVp3sdNlkRDzfv9Qq4ZJOHfg2IUdOjUFDh-U42wp7kJAA 2025-02-04 15:42:20+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113946377498057596 2025-02-04 17:33:15+00:00| seen|...

CVE-2023-38205

creationtimestamp| type| source ---|---|--- 2023-07-20 05:34:05+00:00| exploited| https://t.me/thehackernews/3620 2023-07-20 06:46:04+00:00| exploited| https://t.me/KomunitiSiber/515 2023-07-20 07:09:27+00:00| exploited| Telegram/m5JSB14XcE4WmSFl9S5T7USgeuaPM5JvS0hspkLyulXfQ 2023-07-20...

Vault.sponsor may take away the prize chance from the receiver.

Lines of code Vulnerability details Impact TwabController.delegateBalance is related to the probability to get the prize, and Vault.sponsor can make the others' delegateBalance to 0. A malicious user can send a small amount of assets to every depositor and be the only prize taker. Proof of Concep...

CVE-2023-36517

creationtimestamp| type| source ---|---|--- 2023-07-11 12:42:45+00:00| seen| https://t.me/cibsecurity/66330...

CVE-2019-8451

creationtimestamp| type| source ---|---|--- 2023-06-16 15:55:55+00:00| seen| https://t.me/criticalbug/975 2023-11-17 08:44:59+00:00| seen| https://t.me/arpsyndicate/242 2024-03-18 07:23:33+00:00| published-proof-of-concept| https://t.me/lostsec/164 2024-10-09 19:49:41+00:00| seen|...

CVE-2023-0853

creationtimestamp| type| source ---|---|--- 2023-05-11 16:15:26+00:00| seen| https://t.me/cibsecurity/63881...

CVE-2023-2096

creationtimestamp| type| source ---|---|--- 2023-04-15 14:36:43+00:00| seen| https://t.me/cibsecurity/62218 2023-11-25 05:39:26+00:00| seen| https://t.me/arpsyndicate/574 2023-12-10 14:53:45+00:00| seen| https://t.me/arpsyndicate/1640...

CVE-2021-27876

creationtimestamp| type| source ---|---|--- 2022-09-23 16:55:16+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagentshaauthrce.rb 2023-04-11 08:50:00+00:00| exploited| https://t.me/KomunitiSiber/83 2023-06-14 21:10:04+00:00| seen|...

blockTimestampLast not initialised to block.timestamp results in wrong calculations for reservesCumulative and totalSupplyCumulative in _update() function

Lines of code Vulnerability details Impact Default value of blockTimestampLast is 0 and affects the calculations done in the first call of update. observations would store the wrong value and affect subsequent calculations of price when a sample size that includes this wrong observation is taken...

Sudden price fluctuations occuring at a call to _update() will not be reflected by reserves(), sampleReserves() and sampleSupply() until after periodSize seconds

Lines of code Vulnerability details Impact Consider the situation where a token suddenly drops drastically in price in the market. Consider a call to BaseV1Pair.swap which makes a very large swap between the two tokens accurately reflecting the change in price and also causes a new observation to...

CVE-2022-38766

creationtimestamp| type| source ---|---|--- 2022-08-26 16:58:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3048 2022-08-29 11:37:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6693 2022-09-27 07:30:24+00:00| published-proof-of-concept|...

CVE-2022-2314

creationtimestamp| type| source ---|---|--- 2022-08-15 14:37:48+00:00| seen| https://t.me/cibsecurity/48135 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-09 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-02-09...

CVE-2022-2487

creationtimestamp| type| source ---|---|--- 2022-07-20 16:19:56+00:00| seen| https://t.me/cibsecurity/46638 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-08 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-02-08...

period size is incorrectly set

Lines of code Vulnerability details Impact Instead of setting periodSize to 1800 30 min, it is currently set to 0 which means new observations will get added each time update is called at BaseV1-core.solL166 Proof of Concept 1. Observe that periodSize is set to 0 2. BaseV1-core.solL166 will alway...

Siemens SINEMA Remote Connect Server 安全特征问题漏洞

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunnel connections VPNs between headquarters, service technicians, and installed machines or plants.Siemens SINEMA Remote Connect Server is vulnerable to an encryption issue that could be exploited by an...

CVE-2022-26352

creationtimestamp| type| source ---|---|--- 2022-05-04 14:13:23+00:00| seen| https://t.me/thehackernews/2146 2022-06-02 13:52:54+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/dotcmsfileuploadrce.rb 2022-07-03 06:46:51+00:00|...

CVE-2022-22947

creationtimestamp| type| source ---|---|--- 2022-03-03 07:20:24+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1569 2022-03-03 10:49:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1570 2022-03-03 13:15:08+00:00| published-proof-of-concept|...

CVE-2021-46158

creationtimestamp| type| source ---|---|--- 2022-02-09 18:13:07+00:00| seen| https://t.me/cibsecurity/37075...

The vulnerability of the AADI GeoView Webservice, a software tool for meteorological observations, lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary SQL commands.

The vulnerability of the AADI GeoView Webservice software for meteorological observations lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...