11724 matches found
zola path traversal vulnerability
zola is a fast static site generator in a binary with everything built in. A security vulnerability exists in zola versions 0.13.0 through 0.17.2, which stems from a path traversal vulnerability in which the handlerequest function does not filter for special path controllers in the URL. An attack...
PT-2023-27355 · Zola · Zola
Name of the Vulnerable Software and Affected Versions: zola versions 0.13.0 through 0.17.2 Description: An issue was discovered in the custom implementation of a web server, available via the "zola serve" command, which allows directory traversal. The handle request function, used by the server t...
Missing validation for the _l1TimelockMinDelay parameter in the constructor to ensure it's within a reasonable or expected range.
Lines of code Vulnerability details Impact The constructor accepts a parameter l1TimelockMinDelay and assigns it to l1TimelockMinDelay without performing any validation checks. This means potentially erroneous or extreme values can be set, which could cause undesired behaviors in the system or op...
Nextcloud user_oidc security vulnerability
Nextcloud useroidc is an application from Nextcloud, Germany. A security vulnerability exists in Nextcloud useroidc version 1.0.0 through versions prior to 1.3.3, which stems from a lack of validation of the issuer...
CVE-2023-33241
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...
Design/Logic Flaw
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...
CVE-2023-33241 GG18 / GG20 TSS Beta Parameter Vulnerability
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...
CVE-2023-33241 GG18 / GG20 TSS Beta Parameter Vulnerability
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...
@ai-em/opentelemetry-nestjs (5.0.0), @amplication/opentelemetry-nestjs (>=1.0.0, <=4.2.1) +260 more potentially affected by unknown CVE via @opentelemetry/instrumentation (>=0.40.0, <=0.41.1)
@opentelemetry/instrumentation NPM version =0.40.0, =1.0.0, =1.0.14, =1.0.20, =3.0.1, =0.0.0-2023-07-27--11-15, =0.0.1, =0.0.0-alpha.20230501.1, =1.0.0-alpha.20230614.2, =0.1.2, =1.0.0, =2.3.95, =1.0.2-beta.0, =1.0.2-beta.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F8PQ-3926-8GX...
CVE-2023-38208 Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier and 2.4.4-p4 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated...
CVE-2022-47185
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
DEBIAN-CVE-2022-47185
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
Input validation
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
CVE-2022-47185
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
UBUNTU-CVE-2022-47185
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
CVE-2022-47185
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
CVE-2022-47185 Apache Traffic Server: Invalid Range header causes a crash
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1...
PT-2023-24237
Name of the Vulnerable Software and Affected Versions Crypto wallets implementing GG18 or GG20 TSS protocol affected versions not specified Description Crypto wallets using the GG18 or GG20 Threshold Signature Scheme TSS protocols are susceptible to an issue where an attacker can extract a full...
PT-2023-4530 · Apache · Apache Traffic Server
Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions through 9.2.1 Description: The issue is caused by improper input validation in the Range Header Handler component of the Apache Traffic Server. This can be exploited by a remote attacker to cause a denial of...
Schneider Electric GP-Pro EX 缓冲区错误漏洞
Schneider Electric GP-Pro EX is a set of HMI interface editing and logic programming software from Schneider Electric France. A buffer overflow vulnerability exists in Schneider Electric Pro-face GP-Pro EX. The vulnerability stems from improper manipulation of restrictions within memory buffer...