161 matches found
PT-2022-8026 · Ecto · Ecto
Name of the Vulnerable Software and Affected Versions: Ecto version 2.2.0 Description: The issue is related to a lack of protection mechanism in the interaction between is nil and raise functions. Specifically, Ecto will not raise on queries with non-explicit nil comparisons, unless they are...
USN-5310-1 glibc vulnerabilities
Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS...
Unspecified Vulnerability in NumPy (CNVD-2021-101680)
NumPy is a Python scientific computing package. The product supports a large number of dimensional arrays and matrix calculations, as well as providing a large library of mathematical functions for data operations. A security vulnerability exists in NumPy 1.9 that stems from incomplete string...
Cvxopt 安全漏洞
Cvxopt is a freeware package for convex optimization based on the Python programming language. cvxopt A security vulnerability exists in cvxop 1.2.6 and earlier versions, which stems from incomplete string comparisons in the API. An attacker can use this vulnerability to conduct a denial of servi...
NumPy 安全漏洞
NumPy is a Python scientific computing package. The product supports a large number of dimensional arrays and matrix calculations, as well as providing a large library of mathematical functions for data operations. A security vulnerability exists in NumPy 1.9 that stems from incomplete string...
Trying to use timestamps with blocknumbers
Handle goatbug Vulnerability details Impact requirebondTimestamp + ONEDAY block.number; There are require statements comparing timestamps to blocknumbers. We cannot assume one block per second, this code would not work on different chains where block times radically differ. The effect is having...
The vulnerability in the `parser_parse_statements` function of the `js-parser-statm.c` component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to trigger a service failure.
The vulnerability of the parserparsestatements function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to incorrect comparisons. Exploiting this vulnerability could allow a remote attacker to cause a service...
The vulnerability of the Prosody Jabber/XMPP server lies in the simultaneous execution using a shared resource with incorrect synchronization, allowing an attacker to gain access to confidential data.
The vulnerability of the Prosody Jabber/XMPP server is related to the use of an algorithm with non-persistent execution time for comparing secret strings. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...
The vulnerability in the `parser_parse_function_statement` function of the `js-parser-statm.c` component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to trigger a service failure.
The vulnerability of the parserparsefunctionstatement function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to incorrect comparisons. Exploiting this vulnerability could allow a remote attacker to cause a...
hestiacp 安全漏洞
hestiacp is a lightweight and powerful control panel for the modern web. A security vulnerability exists in hestiacp that stems from hestiacp's tendency to use incorrect operators in string comparisons...
Arithmetic Error - manualRebalance function has multiple arithmetic bugs
Handle tabish Vulnerability details In short there are 2 errors in manualRebalance function : a ratio currentLockRatio has been compared to balance newLockRatio and at another point in the same function subtracted . 1 Expanding on the first one - checking newLockRatio Solution: Instead the if...
CVE-2021-37550
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...
CVE-2021-37550
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...
Design/Logic Flaw
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...
CVE-2021-37550
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...
CVE-2021-37550
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used...
CVE-2021-37550
CVE-2021-37550 concerns JetBrains YouTrack. The vulnerability arises from time-unsafe comparisons in YouTrack prior to version 2021.2.16363 (JT-63697). The issue affects YouTrack and is addressed by the fix in 2021.2.16363, as noted in JetBrains Security Bulletin Q2 2021. The available documents ...
DEBIAN-CVE-2021-31866
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController...
Updates to Snort setup guides
Our documentation on Snort 3 running on CentOS and the Snort Rules Writing guide to Snort 3. Thanks to community member Yaser for providing the updates. The Snort 3 guide now has expanded information on logging options — such as syslog and JSON. There is also a new performance optimization sectio...
CVE-2020-7043
An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack...