GHSA-2WW3-FXVQ-293J NLTK Vulnerable to REDoS

The nltk package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide as an input to the readcomparisonblockhttps://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparativesents.pyL259 function in the file...

PT-2024-11367

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0-syzkaller Description The issue arises from a signed/unsigned comparison in the expression info-size goal - skb-len 0, which evaluates to true when the size goal is smaller than the skb size. This results ...

CLSA-2021-1632262184 Fix of CVE: CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination...

CVE-2020-16630: Incorrect Authorization

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairin...

Facebook’s own research reveals the harm that Instagram can inflict

For years, people have accused social media, and particularly image-driven sites like Instagram, of being bad for young people, particularly young women. It turns that Instagrams owner, Facebook, agrees. Thirty-two percent of teen girls said that when they felt bad about their bodies, Instagram...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

Design/Logic Flaw

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797 Use of Wrong Operator in String Comparison in hestiacp/hestiacp

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

CVE-2021-3797

The CVE-2021-3797 entry for hestiacp has concrete technical details in connected data: in huntr’s description of hestiacp/hestiacp, a CSRF token check uses the != operator to compare $_SESSION["token"] with $_GET["token"] in index.php. This type juggling can bypass the CSRF token, enabling CSRF a...

CVE-2021-3797: Use of Wrong Operator in String Comparison

hestiacp is vulnerable to Use of Wrong Operator in String Comparison...

PT-2021-21935

Name of the Vulnerable Software and Affected Versions: hestiacp affected versions not specified Description: The issue is related to the use of a wrong operator in string comparison. There is no information provided about the estimated number of potentially affected devices worldwide or real-worl...

in hestiacp/hestiacp

✍️ Description $SESSION"token" is a csrf token which is a md5 hash generated based on system time. It has been discovered that $SESSION"token" compares with $GET"token" using comparison operator != in file index.php. This might cause unexpected behavior due to type juggling. It is possible to...

Authorization Policy Bypass Due to Case Insensitive Host Comparison

Impact According to RFC 4343, Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy...

CVE-2021-40147

EmTec ZOC before 8.02.2 allows \e201 pastes, a different vulnerability than CVE-2021-32198...

Privilege Escalation

github.com/istio/istio is vulnerable to privilege escalation. Lack of case-sensitive comparison of hostname in the HTTP Host header allows an attacker to bypass the authorization policy as it causes the Envoy proxy to route the request hostname in a case-insensitive way...

Incorrect Comparison in sodiumoxide

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...

GHSA-WRVC-72W7-XPMJ Incorrect Comparison in sodiumoxide

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties...