4089 matches found
The vulnerability lies in the implementation of “chain” compression mechanisms for the HTTP utility tool cURL, which allows a attacker to trigger a service failure.
The vulnerability of the “chain” compression mechanism implemented in the CURL command-line utility relates to the ability to perform an infinite number of decompression steps of server HTTP responses, which can lead to uncontrolled memory consumption. Exploiting this vulnerability allows a remot...
PT-2023-28603 · Kyverno · Kyverno
Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.11.0 and later, built from the main branch Description: A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause a denial of service. The issue lies in Kyverno's Notary verifier. ...
The vulnerability of the Ghost content management system, related to inconsistencies in responses to incoming requests, allows a hacker to disclose confidential information.
The vulnerability of the Ghost content management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability allows a malicious actor to disclose confidential information through a specially crafted HTTP request...
Spammers abuse Google Forms’ quiz to deliver scams
Spammers are exploiting the "Release scores" feature of Google Forms quizzes to deliver email. The emails originate from Googles own servers and consequently may have an easier time bypassing anti-spam protections and finding the victims inbox. Volumes of these messages hovered near noise levels...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated. A security vulnerability exists in Qualcomm Chipsets that originates from a transient denial of service in the WLAN firmware when parsing WLAN beacons or probing response frames...
UrBackup Security Vulnerability
UrBackup is an open source backup and recovery system for multiple platforms. A security vulnerability exists in UrBackup Server version 2.5.31, which stems from a failure message that confirms an invalid username and can be exploited by an attacker to brute force enumerate user accounts...
Rocky Linux 8 : firefox (RLSA-2022:8554)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8554 advisory. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined wi...
Curl is vulnerable to a denial-of-service (DoS) issue
Curl is vulnerable to a denial-of-service DoS issue due to how some HTTPs servers handle cookies that contain 'control-bytes' / 'control codes' byte values below 32. When curl sends cookies that contain these bytes to an HTTPs server, it may return a 400 response which effectively allows a "siste...
CVE-2023-4535
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...
UBUNTU-CVE-2023-40661
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...
UBUNTU-CVE-2023-4535
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...
CVE-2023-4535 Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...
CVE-2023-4535
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...
CVE-2023-4535 Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...
OpenSC Security Vulnerabilities
OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC that stems from the presence of an out-of-bounds read vulnerability that allows an attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the...
CVE-2023-42670 Samba: ad dc busy rpc multiple listener dos
A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes for example,...
F5 Networks BIG-IP : TMM vulnerability (K70415522)
The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.4. It is, therefore, affected by a vulnerability as referenced in the K70415522 advisory. - On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of...
CVE-2023-5515
The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications...
