The vulnerability of the Joomla! content management system is related to the incorrect duration of the session, which allows an attacker to access confidential data.

The vulnerability of the Joomla! content management system is related to an incorrect session duration. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

The vulnerability of the PAN-OS operating system’s management interface allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the PAN-OS operating system’s management interface is related to incorrect session duration settings. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

PT-2024-10422

Name of the Vulnerable Software and Affected Versions FFmpeg version 6.1.1 Description The issue is related to an integer overflow vulnerability in the parse options function of sbgdec.c within the libavformat module. This vulnerability allows for negative duration values to be accepted without...

The vulnerability of the /cgi-bin/cstecgi.cgi file of the Totolink N350RT router’s microprogramming system, which allows a hacker to disclose protected information.

The vulnerability of the /cgi-bin/cstecgi.cgi file of the Totolink N350RT router’s microprogramming system is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming software for the Totolink T8 router, allows a hacker to disclose protected information.

The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming system for the Totolink T8 router, is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming software for the Totolink N200RE router, allows a hacker to disclose protected information.

The vulnerability of the /cgi-bin/cstecgi.cgi file of the Totolink N200RE router’s microprogramming system is related to an incorrect session duration. Exploiting this vulnerability can allow a remote attacker to disclose protected information...

From Megabits to Terabits: Gcore Radar Warns of a New Era of DDoS Attacks

As we enter 2024, Gcore has released its latest Gcore Radar report, a twice-annual publication in which the company releases internal analytics to track DDoS attacks. Gcore's broad, internationally distributed network of scrubbing centers allows them to follow attack trends over time. Read on to...

The vulnerability of the Slurm resource manager, related to incorrect session duration settings, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Slurm resource manager is related to an incorrect session duration setting. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

PT-2024-1089 · D Link · D-Link Dcs-8300Lhv2

Name of the Vulnerable Software and Affected Versions: D-Link DCS-8300LHV2 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploi...

griefer can create maximum length time locks for other users with only dust

Lines of code Vulnerability details Description veOLAS is the voting token for the OLAS protocol. It functions like the curve.fi voting token in that a user gets more votes the longer they lock their tokens. A user can create a lock for themselves or have another user create a lock for them, usin...

The vulnerability of the `max_request_duration` component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to trigger a service failure.

The vulnerability of the maxrequestduration component in the HashiCorp Vault and Vault Enterprise platforms for archiving corporate information involves unlimited resource allocation during HTTP request processing. Exploiting this vulnerability could allow a malicious actor to cause service...

Building an AppSec Program with Qualys WAS -Introduction and Configuring a Web Application or API: Default Scan Settings

Qualys WAS Web Application Scanning tools stand out as The Leading Dynamic Application Security Testing DAST solutions in the industry. Since it comes with default scan settings, understanding these settings in detail is critical to uncover vulnerabilities effectively. Scan performance and covera...

Upgraded Q -> 2 from #491 [1701115520323]

Judge has assessed an item in Issue 491 as 2 risk. The relevant finding follows: L-03 While StakedUSDeV2.cooldownDuration is changed from non-zero to zero, stakers should be able to call StakedUSDeV2.unstake to withdraw assets regardless of userCooldown.cooldownEnd File: While...

AuctionDemo::claimAuction() - L105: Logic bug in the conditional statement where the timestamp check should be > instead of >=.

Lines of code Vulnerability details Impact Would enable the winning bidder/bid to be selected WHILE it's still possible to bid higher in the auction. I.e. current comparison logic makes it possible to select auction winner while the auction isnt over yet. there's the risk of the true/valid highes...

A flaw was discovered in the XFS source in the Linux kernel (CVE-2020-12655)

An issue was discovered in xfsagfverify in fs/xfs/libxfs/xfsalloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767...

It is possible to prematurely unlock assets that should still be locked up by setting the cooldown duration to 0.

Lines of code Vulnerability details Impact It undermines the security of the cooldown period. Specifically: • Users who have assets locked up in the cooldown period could immediately withdraw them if the admin sets the duration to 0. This violates the intent of having a cooldown period to begin...

Important: Red Hat Security Advisory: Run Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update

An update for run-once-duration-override-container, run-once-duration-override-operator-bundle-container, and run-once-duration-override-operator-container is now available for RODOO-1.0-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

The vulnerability of the BIG-IP Access Policy Manager, as well as software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibility and Reporting (AVR), BIG-IP DDos Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Inforcement Manager, BIG-IP SSL Orchestrator, BIG-IP Webaccelerator, and BIG-IP WebSafe, is related to incorrect session duration settings. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

The vulnerability of the protection mechanism for detecting and responding to security threats at FortiEDR endpoints stems from the incorrect validity period of the session. This allows attackers to execute arbitrary codes.

The vulnerability of the security protection mechanism for detecting and responding to security threats at FortiEDR endpoints is related to the incorrect duration of the session. Exploiting this vulnerability allows a remote attacker to execute arbitrary codes...