yii2 security vulnerabilities

yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in yii2-authclient versions prior to 2.2.15, which stems from the possibility of a timing attack in string comparison...

Incorrect Termination Condition

Lines of code Vulnerability details The provided termination condition if pos = size / 2 && pos = size is incorrect. This condition is not suitable for terminating the maxHeapify function. It should instead be based on comparing values in the heap to ensure the max heap property. The condition if...

yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison instead of Yii::$app-getSecurity-compareString. Affected Code: 1. OAuth 1 "state"...

GHSA-W8VH-P74J-X9XP yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison instead of Yii::$app-getSecurity-compareString. Affected Code: 1. OAuth 1 "state"...

CLSA-2023-1702573728 Fix CVE(s): CVE-2022-48560

SECURITY UPDATE: Posible crash in heapq with custom comparison operators - debian/patches/CVE-2022-48560.patch: Disallow releasing heap items during a comparison callback - CVE-2022-48560...

CLSA-2023-1702573269 Fix CVE(s): CVE-2022-48560

SECURITY UPDATE: Posible crash in heapq with custom comparison operators - debian/patches/CVE-2022-48560.patch: Disallow releasing heap items during a comparison callback - CVE-2022-48560...

Monolith Versus Microservices: Weigh the Pros and Cons of Both Configs

...

SolarWinds Platform 2023.3.x < 2023.3.1 Multiple Vulnerabilities

The version of SolarWinds Platform installed on the remote host is prior to 2023.3. It is, therefore, affected by multiple vulnerabilities as referenced in the security advisory. - The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users...

The vulnerability of the UpdateAction method in SolarWinds Orion software allows a hacker to execute arbitrary code with privileges of the Network Service.

The vulnerability of the UpdateAction method in the SolarWinds Orion Platform’s network monitoring software lies in improper string comparison. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code with privileges of the Network Service...

mariadb: server crash in component arg_comparator::compare_real_fixed

A flaw was found in MariaDB. The component, Argcomparator::comparerealfixed, allows attackers to cause a denial of service DoS via specially crafted SQL statements, affecting availability...

CVE-2023-21671

Memory Corruption in Core during syscall for Sectools Fuse comparison feature...

CVE-2023-21671

CVE-2023-21671 is described across multiple sources as a memory corruption issue in Core during a syscall for the Sectools Fuse comparison feature. Public descriptions consistently state memory corruption in a Qualcomm-related Core/closed-source component, with a local attacker and high to critic...

CVE-2023-21671 Improper Input Validation in Core

Memory Corruption in Core during syscall for Sectools Fuse comparison feature...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a core memory corruption during a system call to the Sectools Fuse comparison function...

PT-2023-18332 · Core · Core

Name of the Vulnerable Software and Affected Versions: Core affected versions not specified Description: The issue is related to memory corruption in Core during a syscall for the Sectools Fuse comparison feature. Recommendations: At the moment, there is no information about a newer version that...

CVE-2023-21671: Improper Input Validation

Memory Corruption in Core during syscall for Sectools Fuse comparison feature...

Timing Attack

generator-jhipster is vulnerable to a Timing Attack. The vulnerability exists because the TokenProvider.java uses String.equalsstr to compare the given token-signature. This comparison method does not effectively validate the token because it stops as soon as it encounters the first character tha...

generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

GHSA-4GPM-R23H-GPRW generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

Design/Logic Flaw

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...