8612 matches found
Titra security vulnerabilities
titra is a modern open source time tracking project for freelancers and small teams. A security vulnerability exists in versions prior to titra 0.77.0, which stems from improperly neutralized formula elements in CSV files...
PT-2022-15876
Name of the Vulnerable Software and Affected Versions ZTE MF297D affected versions not specified Description The issue is related to cryptographic problems due to the use of weak random values, which reduces the security of the device and may increase the risk of attack. Recommendations At the...
CVE-2022-23138: Use of Insufficiently Random Values
ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the risk of attack...
SevOne Network Management System security vulnerabilities
SevOne Network Management System is the most comprehensive, scalable and application-centric network performance monitoring system for modern NetOps from SevOne. A CSV injection vulnerability exists in SevOne Network Management System versions 5.7.2.0 inclusive through 5.7.2.22 inclusive, which c...
CVE-2022-32296: Use of Insufficiently Random Values
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 "Double-Hash Port Selection Algorithm" of RFC 6056...
PT-2022-4550
Name of the Vulnerable Software and Affected Versions YOKOGAWA Wide Area Communication Router WAC Router AW810D affected versions not specified Description A vulnerability exists in the Vnet/IP communication module VI461, related to the use of insufficiently random values. This issue may allow a...
EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-1782)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the Linux kernel's cgroupreleaseagentwrite in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain...
mariadb: save_window_function_values triggers an abort during IN subquery
savewindowfunctionvalues in MariaDB before 10.6.3 allows an application crash because of incorrect handling of withwindowfunc=true for a subquery...
PT-2022-13965 · WordPress · Quotes Llama Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Quotes llama WordPress plugin versions prior to 1.0.0 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed. This can be achieved by exploiting the...
Users can get unlimited votes
Lines of code Vulnerability details Impact Users can get unlimited votes which leads to them: 1. gaining control over governance 2. getting undeserved rewards 3. having their pools favored due to gauge values Proof of Concept mint calls moveTokenDelegates to set up delegation... File:...
RHEL 8 : RHV Host (ovirt-host) (RHSA-2022:4764)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4764 advisory. The ovirt-host package consolidates host package requirements into a single meta package. Security Fixes from Bugzilla: vdsm: disclosure of sensitive...
vdsm: disclosure of sensitive values in log files
A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text...
USN-5448-1: ncurses vulnerabilities
It was discovered that ncurses was not properly checking array bounds when executing the fmtentry function, which could result in an out-of-bounds write. An attacker could possibly use this issue to execute arbitrary code. CVE-2017-10684 It was discovered that ncurses was not properly checking us...
Anker Eufy Homebase get_aes_key_info_by_packetid Authentication Bypass
The vulnerability of the getaeskeyinfobypacketid function in Anker Eufy Homebase surveillance systems is related to a small number of possible random values. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...
CVE-2022-26026
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to trigger this vulnerability...
AttesterSlashing number overflow
Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...
GHSA-CVJ7-5F3C-9VG9 AttesterSlashing number overflow
Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...
GHSA-JXFP-4RVQ-9H9M scikit-learn Denial of Service
svmpredictvalues in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of service segmentation fault via a crafted model SVM introduced via pickle, json, or any other model permanence standard with a large value in the nsupport array. NOT...
GHSA-C7RM-W2HJ-X8G3 Guard bypass in Eloquent models affecting Laravel illuminate database component
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database component in some situations in which table names are stripped during a mass assignment...