10196 matches found
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
Improper access control
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...
H-01 Unmitigated
Lines of code Vulnerability details test test --- The text was updated successfully, but these errors were encountered: All reactions...
CVE-2023-37759
The CVE-2023-37759 entry concerns Crypto Currency Tracker (CCT) prior to v9.5, where an improper access control in the User Registration page allows unauthenticated attackers to create an Admin account. The vulnerability is triggered via a crafted POST to /en/user/register (as shown in Exploit-DB...
Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2023-2238 (ALAS-2023-2238)
The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1377.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2238 advisory. A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fa...
Amazon Linux 2023 : cni-plugins (ALAS2023-2023-338)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-338 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...
GO-2023-2045 Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
Important: amazon-ssm-agent
Issue Overview: The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. CVE-2021-43565 A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentification with R...
FreeBSD : go -- multiple vulnerabilities (beb36f39-4d74-11ee-985e-bff341e78d94)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the beb36f39-4d74-11ee-985e-bff341e78d94 advisory. - The Go project reports: cmd/go: go.mod toolchain directive allows arbitrary execution The...
Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach
In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people...
go -- multiple vulnerabilities
The Go project reports: cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to...
World’s Largest Cryptocurrency Casino Stake Hacked for $41 Million
By Deeba Ahmed Ethereum Network Stake Loses $41 Million Worth of Crypto After Private Key Leak. This is a post from HackRead.com Read the original post: Worlds Largest Cryptocurrency Casino Stake Hacked for $41 Million...
Upgraded Q -> 2 from #26 [1693915911684]
Judge has assessed an item in Issue 26 as 2 risk. The relevant finding follows: Curve Read-only Reentrancy can increase the price of some CurveStableCollateral --- The text was updated successfully, but these errors were encountered: All reactions...
Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities
Summary IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the...
Upgraded Q -> 2 from #112 [1693761181150]
Judge has assessed an item in Issue 112 as 2 risk. The relevant finding follows: If a profile gets blocked, the user can refollow by accepting a pre-upgrade followNFT and then using the batchMigrateFollows function. --- The text was updated successfully, but these errors were encountered: All...
Golang < 1.19.12 / 1.20.x < 1.20.7 DoS
The version of Golang Go installed on the remote host is affected by denial of service vulnerability. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is...
