3544 matches found
Cisco IOS Software Common Industrial Protocol Request DoS (cisco-sa-iosxe-cip-dos-9rTbKLt9)
A vulnerability in the processing of malformed Common Industrial Protocol CIP packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service DoS condition...
ROS-20221004-01
Vim text editor vulnerability is related to a boundary error during file processing in the function exfinally in exeval.c. Exploitation of the vulnerability could allow an attacker acting remotely, create a special file, force the victim to open it, cause memory corruption, and execute arbitrary...
CVE-2022-40923
A vulnerability in the LIEF::MachO::SegmentCommand::virtualaddress function of LIEF v0.12.1 allows attackers to cause a denial of service DOS through a segmentation fault via a crafted MachO file...
CVE-2022-3371 No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3...
CVE-2022-3371 No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3...
CVE-2022-2529
CVE-2022-2529 affects the sflow decode package in Cloudflare’s goflow (github.com/cloudflare/goflow) where insufficient packet sanitisation can allow crafted malformed packets to cause unbounded memory growth, resulting in a denial of service. Multiple connected documents identify the vulnerable ...
CVE-2022-3364 No limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3...
No limit in length of "Token name" parameter results in DOS attack /memory corruption
Proof of Concept 1Go to https://rdiffweb-dev.ikus-soft.com/prefs/tokens endpoint . 2You will see a field called "Token name" 3Here you will see that there is no limit for the "Token name" parameter that allows a user to to set a very long string as long as 1 million characters . 4This may possibl...
No limit in length of "Fullname" parameter results in DOS attack /memory corruption
Proof of Concept 1Go to https://rdiffweb-dev.ikus-soft.com/prefs/general endpoint . 2You will see a field called "Fullname" 3Here you will see that there is no limit for the "Fullname" parameter that allows a user to to set a very long string as long as 1 million characters . 4This may possibly...
Cross site request forgery (csrf)
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service...
rdiffweb allows unlimited length of root directory name, which could result in DoS
rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory...
5 Network Security Threats And How To Protect Yourself
Cybersecurity today matters so much because of everyone's dependence on technology, from collaboration, communication and collecting data to e-commerce and entertainment. Every organisation that needs to deliver services to their customers and employees must protect their IT 'network' - all the...
removeMinter function DoS
Lines of code Vulnerability details Description There is a removeMinter function in ERC20PermitPermissionedMint. The function performs the removal minteraddress from the special address list. In other words, the function is needed to remove special access for a specific address. // Remove a minte...
depositEther function DoS with locking funds
Lines of code Vulnerability details Description There is a depositEther function in frxETHMinter contract. The function performs multiple deposits to the depositContract. More detailed, the contract calculates the amount of ether that was submitted to it, and everything, except withheld amount, i...
An attacker taking over the timelock_address or the owner address will result in DoS and unusable contract (frxETHMinter).
Lines of code Vulnerability details Impact Actions described in the POC result in DoS, if an attacker takes over one of the two "admin" addresses. Proof of Concept By taking over the timeLock or the owner address, the attacker will have access to the following functions moveWithheldETH,...
No Limit in "title" length while adding SSH key , results in memory consumption/DOS attack
Description There must be a fixed length for user input parameters like "title" while adding SSH key. Allowing users to enter long strings may result in a DOS attack or memory corruption Proof of Concept 1Go to https://rdiffweb-demo.ikus-soft.com/prefs/sshkeys endpoint . 2Click on add SSH key...
No Limit in length of root directory name , results in memory consumption/DOS attack
Description There must be a fixed length for user input parameters like root directory name. Allowing users to enter long strings may result in a DOS attack or memory corruption Proof of Concept 1Go to https://rdiffweb-demo.ikus-soft.com/admin/users endpoint . 2Click on add user 3Here you will se...
CVE-2022-40106
Tenda i9 v1.0.0.83828 was discovered to contain a buffer overflow via the setlocaltime function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted string...
No Limit in length of username , results in memory consumption/DOS attack
Description There must be a fixed length for user input parameters like username. Allowing users to enter long strings may result in a DOS attack or memory corruption Proof of Concept 1Go to https://rdiffweb-demo.ikus-soft.com/admin/users endpoint . 2Click on add user 3Here you will see that ther...
CVE-2022-24280
Summary of CVE-2022-24280 : The Proxy component of Apache Pulsar has an input-validation weakness that enables DoS-like TCP/IP connection attempts to originate from the Pulsar Proxy’s IP. Affected versions include 2.7.0–2.7.4; 2.8.0–2.8.2; 2.9.0–2.9.1; and 2.6.4 and earlier. The attacker must hav...