1124 matches found
JOSE vulnerable to resource exhaustion via specifically crafted JWE
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order...
CVE-2022-35220
Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal terminati...
CVE-2022-35220
CVE-2022-35220 affects Teamplus Pro, specifically the Community Discussion feature. A remote attacker with general user privileges can post a thread with large content, triggering an allocation of resources without limits or throttling and causing memory exhaustion on the receiving client, potent...
Leakage Of Private Discussion
fof/byobu is vulnerable to leakage of private discussion. Lack of enforcement of disablement to private discussion allows forum's users to start private discussions with themselves...
Teamplus Pro 安全漏洞
Teamplus Pro is a private cloud version of the app from the Taiwan, China-based company Teamplus. A security vulnerability exists in Teamplus Pro v3.011.6.0.1 and prior versions, which stems from the fact that its Community Discussion feature's unrestricted access to threads containing a large...
Teamplus Pro 安全漏洞
Teamplus Pro is a private cloud version of the app from the Taiwan, China-based company Teamplus. A security vulnerability exists in Teamplus Pro v3.011.6.0.1 and prior versions, which stems from the fact that its Community Discussion feature does not limit the number of threads containing a larg...
Design/Logic Flaw
fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to...
CVE-2022-31184 Email activation route can be abused by spammers in Discourse
Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unabl...
CVE-2022-31184
CVE-2022-31184 affects Discourse; an abuse of the email activation route allows mass-spam via unmitigated email flows. The root cause is not deeply detailed in the provided documents, but the mitigation is explicit: a fix has been included in the latest stable, beta, and tests-passed Discourse re...
CVE-2022-31182
CVE-2022-31182 affects Discourse. A maliciously crafted request for static assets can cause error responses to be cached by Discourse’s default NGINX proxy configuration (cache poisoning). Root cause: incorrect/unsafe caching behavior in the proxy setup when handling static asset requests. Affect...
CVE-2022-35220
Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal terminati...
CVE-2022-31096
Discourse (open source discussion platform) has a vulnerability where a logged-in user can redeem an invite with an email that doesn’t match the invite or violates the invite’s email domain restriction, potentially leading to viewing content restricted to certain groups. The issue is worsened whe...
Online Discussion Forum Site SQL注入漏洞（ CNVD-2022-58959 ）
Online Discussion Forum Site is an application of Sourcecodester. An online discussion forum, Online Discussion Forum Site is vulnerable to a SQL injection vulnerability in /odfs/posts/viewpost.php that lacks validation of externally entered SQL statements. An attacker could use this vulnerabilit...
Online Discussion Forum Site SQL注入漏洞（CNVD-2022-58961 ）
Sourcecodester Online Discussion Forum Site is an application of Sourcecodester, an online discussion forum. A SQL injection vulnerability exists in Sourcecodester Online Discussion Forum Site v1.0, which originates from /odfs/classes/Master.php?f=deleteteam missing filter escaping for SQL data. ...
CVE-2022-31296
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/viewpost.php...
CVE-2022-31296
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/viewpost.php...
CVE-2022-31296
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/viewpost.php...
Sql injection
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/viewpost.php...
CVE-2022-31296
CVE-2022-31296 affects the Sourcecodester-based Online Discussion Forum Site 1. The vulnerability is a blind SQL injection in the /odfs/posts/view_post.php component (parameter: id). Root cause: lack of input validation allows unauthenticated attackers to manipulate SQL queries, enabling data ext...
