25463 matches found
CVE-2023-46739 Timing attack can leak user passwords
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS...
GHSA-4248-P65P-HCRM Insecure random string generator used for sensitive data
CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...
Insecure random string generator used for sensitive data
CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...
CubeFS timing attack can leak user passwords
A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the...
CVE-2023-46739: Observable Discrepancy
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS...
CVE-2023-7180
A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJIDSTR leads to sql injection. The exploit has been disclosed to the...
Tongda2000 SQL Injection Vulnerability
Tongda2000 is a network intelligent office system of China Tongda Tongda company. Tongda2000 11.9 and earlier versions exist SQL injection vulnerability, the vulnerability stems from the parameter PROJIDSTR in the file general/project/proj/delete.php can lead to SQL injection...
Null pointer dereference
OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service NULL pointer dereference, daemon crash, and Captive Portal outage via a GET request to /openndsauth/ that lacks a custom query string parameter and client-token...
CVE-2023-38321
OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service NULL pointer dereference, daemon crash, and Captive Portal outage via a GET request to /openndsauth/ that lacks a custom query string parameter and client-token...
Sql injection
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address...
CVE-2023-49954: Improper Neutralization of Special Elements used in an SQL Command
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address...
CVE-2023-49954
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address...
CVE-2023-28376
creationtimestamp| type| source ---|---|--- 2023-12-22 00:26:36+00:00| seen| https://t.me/ctinow/158083...
yii2 security vulnerabilities
yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in yii2-authclient versions prior to 2.2.15, which stems from the possibility of a timing attack in string comparison...
SUSE SLED15: libQt5Bootstrap-devel-static / libQt5Bootstrap-devel-static-32bit / etc (SUSE-SU-2023:4951-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4951-1 advisory. - CVE-2023-37369: Fixed buffer overflow in QXmlStreamReader bsc1214327. - libq5-qtbase was rebuild agains...
PT-2023-35662 · Git +1 · Jq
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 2 crash has been reported. The crash involves the functions jv string vfmt, jv string fmt, and jv get. No information is...
Fortinet FortiProxy,FortiOS,FortiPAM Formatting String Error Vulnerability
Fortinet FortiProxy is a secure network proxy from Fortinet that protects employees from cyberattacks by combining multiple detection technologies such as Web filtering, DNS filtering, DLP, anti-virus, intrusion prevention, and advanced threat protection.FortiProxy helps reduce bandwidth...
jq:jq_fuzz_execute: Heap-buffer-overflow in jv_string_vfmt
Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=6170924017385472 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzexecute Job Type: libfuzzerasanjq Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x603000000201 Crash...
postgresql: Memory disclosure in aggregate function calls
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...