Improper Authentication

pulsar-websocket is vulnerable to Improper authentication. The vulnerability arises due to a lack of authentication a user makes request to the /pingpong endpoint. The attacker can potentially trigger a DoS attack or perform excessive data transfer as a result of this vulnerability...

Owners of LPs can be dosed when removing their position

Lines of code Vulnerability details Summary LP owners can reclaim liquidity to stop it from being extended for current liens but this doesn't stop from being used in new positions. Impact LP owners can signal their intention to pull liquidity by calling reclaimLiquidity. This function updates the...

Apache Doris Authorization Issues Vulnerability

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an authorization issue vulnerability that stems from api /api/snapshot and /api/getlogfile allowing...

CVE-2023-46266

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack...

Design/Logic Flaw

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack...

Design/Logic Flaw

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack...

CVE-2023-46266

CVE-2023-46266 affects Ivanti Avalanche SecureFilter in Ivanti Avalanche; a remote attacker can send specially crafted requests to bypass authentication via Content-Type/URI handling, causing potential data leakage or DoS. Public sources describe it as a Content-Type authentication bypass vulnera...

CVE-2021-22962

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack...

CVE-2021-22962

CVE-2021-22962 concerns Ivanti Avalanche (Wavelink), where a specially crafted request could cause leakage of sensitive data or a resource-based DoS. The available documents describe the issue in general terms (data leakage/DoS) without detailing affected subcomponents, versions, or the exact roo...

CVE-2023-41314

The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...

Design/Logic Flaw

The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...

CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS

The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...

CVE-2023-41314

CVE-2023-41314 affects Apache Doris; the vulnerability arises from unauthenticated access to /api/snapshot and /api/get_log_file, potentially enabling DoS and retrieval of arbitrary files from FE nodes. Worldwide references indicate affected product is Doris and advise upgrading to version 2.0.3 ...

Insecure Deserialization

dubbo is vulnerable to Insecure Deserialization. The vulnerability is caused due to lack of validation of untrusted user data. An attacker can modify application data, perform a DoS attack or execute arbitrary code by exploiting this vulnerability...

Providing LP outside of active range is prone to DoS

Lines of code Vulnerability details Impact When LP provide uniswap V3 position using ParticlePositionManager that have range outside of active price, it can be DoSed by opening position of all the provided liquidity. Proof of Concept When LPs provide a Uniswap V3 position that is currently outsid...

Oracle Linux 9 : postgresql:15 (ELSA-2023-7785)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7785 advisory. pgaudit pgrepack postgres-decoderbufs postgresql 15.5-1 - update to 15.5 - Fixes CVE-2023-5868, CVE-2023-5869, CVE-2023-5870, CVE-2023-39417, and...

AlmaLinux 9 : postgresql:15 (ALSA-2023:7785)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7785 advisory. postgresql: Buffer overrun from integer overflow in array modification CVE-2023-5869 postgresql: Memory disclosure in aggregate function calls CVE-2023-58...

Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2023-3369)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Node.js: Denial of Service by resource exhaustion in fetch() brotli decoding

A denial of service vulnerability was identified in Node.js related to resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The issue stems from fetch always decoding Brotli content, allowing an attacker controlling the URL to cause resource exhaustion...

Siemens SINEC INS Denial of Service Vulnerability

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...