57 matches found
CVE-2023-4720
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV...
Tadiran Telecom Aeonix 安全漏洞
Tadiran Telecom Aeonix is a purely software-based Unified Communications and Collaboration UC&C solution from Tadiran Telecom, Israel. A security vulnerability exists in Tadiran Telecom Aeonix that stems from the presence of a false comparison vulnerability that allows an attacker to conduct an...
Spoofing
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server...
GitHub Enterprise Server 安全漏洞
GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of...
CVE-2023-23843
The CVE-2023-23843 entry concerns SolarWinds Platform’s UpdateActionsProperties Incorrect Comparison vulnerability. It enables authenticated attackers with administrative access to SolarWinds Web Console to execute arbitrary code/commands; ZDI specifics indicate remote code execution in the conte...
PT-2023-4415 · Solarwinds · Solarwinds Orion Platform
Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform affected versions not specified Description: The issue is related to an Incorrect Comparison Vulnerability in the SolarWinds Orion Platform, specifically in the BlacklistedFilesChecker class. This vulnerability allow...
GitHub: Smuggling content in PR with refs/replace in GitHub
An incorrect comparison vulnerability was found in GitHub Enterprise Server, allowing commit smuggling through the display of an incorrect diff in the GitHub pull request UI. This vulnerability required write access to the repository and affected versions 3.7.0 and above. It was fixed in versions...
GitHub Enterprise Server 安全漏洞
GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up one's GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of an...
Invalid tokens can be added to the pair
Lines of code Vulnerability details Impact merkleRoot is a bytes32 and it is compared to bytes230 which makes it possible for a non-zero merkleRoot to be set in the constructor and yet still all tokens will be declared as valid Proof of Concept Tools Used Manual Audit Recommended Mitigation Steps...
CVE-2022-41914 Non-constant-time SCIM token comparison in Zulip Server
Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity ManagementSCIM account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be...
Debian dla-3152 : glibc-doc - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3152 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3152-1 [email protected]...
CVE-2022-43411
Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...
Comparison of tokens
Lines of code Vulnerability details Impact In function named getUnderlyingPrice the BaseV1Router01 contract desides price of the token by comparing tokens' symbol name with predefined constant. By passing custom token attacker can force returned value of getUnderlyingPrice function to be incorrec...
PT-2022-37421 · Unknown · Interledger
Name of the Vulnerable Software and Affected Versions: Interledger affected versions not specified Description: The Interledger family of crates is no longer actively maintained, and the owner of the published crate is unresponsive. There is a concern regarding username comparison, which may or m...
CVE-2022-22203
CVE-2022-22203 affects Juniper Networks Junos OS 19.4 (19.4R3-S4) on QFX5000 Series and EX4600/EX4650 platforms. Affected component: PFE (fxpc process). Root cause: Incorrect Comparison vulnerability that, when processing a specific hostbound packet, causes fxpc to crash and the FPC to reboot, en...
curl: CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disaster
Summary: CURLOPTSSHHOSTPUBLICKEYSHA256 base64 encoded host fingerprint is compared case-insensitive by accident. This means that it is technically possible however still difficult to create forged ssh host key that matches in this comparison. The bug appears to have been introduced when adding...
Mageia: Security Advisory (MGASA-2014-0493)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-41500
Incomplete string comparison vulnerability exits in cvxopt.org cvxop = 1.2.6 in APIs cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve, which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects...
CVE-2021-41500
Incomplete string comparison vulnerability exits in cvxopt.org cvxop = 1.2.6 in APIs cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve, which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects...