Nuclei Path Traversal vulnerability

Overview We have identified and addressed a security issue in the Nuclei project that affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payloads loading in sandbox mode. Details In the...

GHSA-2XX4-JJ5V-6MFF Nuclei Path Traversal vulnerability

Overview We have identified and addressed a security issue in the Nuclei project that affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payloads loading in sandbox mode. Details In the...

Code injection

Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. Ther...

CVE-2023-37896 Nuclei Path Traversal vulnerability

Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. Ther...

THERE IS NO FUNCTIONALITY TO LIQUIDATE THE DEPRECATED MTOKEN MARKETS

Lines of code Vulnerability details Impact The Mtoken markets configured for the respective collateral asset types can get deprecated due to various reasons associated with those assets. There should be functionality in the Comptroller.liquidateBorrowAllowed function to liquidate all the borrows ...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:2880-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2880-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Vulnerability (SSA:2023-200-01)

The version of curl installed on the remote host is prior to 8.2.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-200-01 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

GO-2023-1881 The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk

If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged. No patch will be released, as the package is planned to be deprecated and replaced...

SUSE: Security Advisory (SUSE-SU-2023:2783-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: libprotobuf-lite20 / python2-cryptography / python2-psutil / etc (SUSE-SU-2023:2783-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2783-1 advisory. grpc: - Update in SLE-15 bsc1197726, bsc1144068 protobuf: - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941,...

Although ERC20Boost.decrementGaugesBoostIndexed function would require user to remove all of her or his boost from a deprecated gauge at once, such user can instead call ERC20Boost.decrementGaugeBoost function for multiple times to utilize such deprecated gauge and decrement its userGaugeBoost for multiple times

Lines of code Vulnerability details Impact When the gauge input corresponds to a deprecated gauge, calling the following ERC20Boost.decrementGaugeBoost function can still execute gaugeState.userGaugeBoost -= boost.toUint128 if boost = gaugeState.userGaugeBoost is false. function...

PT-2023-9603 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 20.x Description: The use of the deprecated API process.binding can bypass the permission model through path traversal, potentially allowing a remote attacker to bypass security restrictions and gain unauthorized access to...

GHSA-W5W5-2882-47PC github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee

x/crisis does not charge ConstantFee Impact If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the x/crisis module are affected on all versions of the Cosmos SDK. Details The x/crisis module is supposed to...

msLDAPDump - LDAP Enumeration Tool

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently. Binding...

Almost all of the github.com/cosmos/cosmos-sdk/types will be deprecated

Lines of code Vulnerability details Impact Codes in the scope won't work if the would be updated. Proof of Concept It is clearly seen that in the it is fixed version of v0.45.9. However, in next version of cosmos-sdk all of the Int methods will be deprecated. Almost all of the code in the scope i...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2023-212)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-212 advisory. A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a...

GHSA-5FP6-4XW3-XQQ3 @keystone-6/core's bundled cuid package known to be insecure

Summary The cuid package used by @keystone-6/ and upstream dependencies is deprecated and marked as insecure by the author. As reported by the author Cuid and other k-sortable and non-cryptographic ids Ulid, ObjectId, KSUID, all UUIDs are all insecure. Use @paralleldrive/cuid2 instead. What are...

@keystone-6/core's bundled cuid package known to be insecure

Summary The cuid package used by @keystone-6/ and upstream dependencies is deprecated and marked as insecure by the author. As reported by the author Cuid and other k-sortable and non-cryptographic ids Ulid, ObjectId, KSUID, all UUIDs are all insecure. Use @paralleldrive/cuid2 instead. What are...

SUSE-SU-2023:2485-1 Security update for gdb

This update for gdb fixes the following issues: gdb was updated to 12.1. jscSLE-21561 DBX mode is deprecated, and will be removed in GDB 13. GDB 12 is the last release of GDB that will support building against Python 2. From GDB 13, it will only be possible to build GDB itself with Python 3...

PT-2023-32980 · Cuid +1 · Cuid +2

Name of the Vulnerable Software and Affected Versions: @keystone-6/ versions affected versions not specified Description: The cuid package is deprecated and marked as insecure by its author due to security concerns. It is recommended to use @paralleldrive/cuid2 instead. The issue affects...