CVE-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interv...

The Global DDoS Threat Landscape – October 2022

Every month in this space, we will post the Global DDoS Threat Landscape blog on behalf of the Imperva Threat Research team. As DDoS attacks continue to pose a significant risk to businesses it is critical that we regularly communicate our Threat Research team’s findings to help the cybersecurity...

GHSA-F4P5-X4VC-MH4V Improper use of metav1.Duration allows for Denial of Service

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured...

Improper use of metav1.Duration allows for Denial of Service

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured...

PT-2022-24860 · Flux · Flux

Name of the Vulnerable Software and Affected Versions: Flux versions prior to 0.35.0 Description: The issue concerns a Denial of Service in Flux, an open and extensible continuous delivery solution for Kubernetes. Users with permissions to change Flux's objects can provide invalid data to fields...

Authentication Bypass

@next-auth/upstash-redis-adapter is vulnerable to authentication bypass. The vulnerability exists because the createVerificationToken function of index.ts does not properly check the token during the email verification, allowing an attacker to get information about the verification token's expire...

Design/Logic Flaw

@next-auth/upstash-redis-adapter is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation...

In VTVLVesting._baseVestedAmount(), the funds might be locked inside the contract forever with uint112 overflow.

Lines of code Vulnerability details Impact In VTVLVesting.baseVestedAmount, the funds might be locked inside the contract forever with uint112 overflow. Currently, it doesn't consider uint112 overflow during multiply and it's very likely to happen when the vesting duration is not short like 1 yea...

Security Bulletin: Mitigations are being announced to address CVE-2020-4839 and CVE-2021-29695

Summary IBM products 8335-GCA, 8335-GTA, and 8335-GTB have identified security vulnerabilities. Vulnerability Details CVEID:CVE-2020-4839 DESCRIPTION: IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileged...

The vulnerability of the BD Synapsys software lies in its incorrect session duration, which allows a perpetrator to gain access, modify, or delete confidential information.

The vulnerability of the BD Synapsys software lies in the incorrect duration of a session. Exploiting this vulnerability can allow an attacker to gain access, modify, or delete confidential information...

The instability of the BigBlueButton server interface’s greenlight feature, related to the incorrect session duration, allows a violator to increase their privileges.

The vulnerability of the BigBlueButton greenlight server interface is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

DEBIAN-CVE-2021-3670

MaxQueryDuration not honoured in Samba AD DC LDAP...

AZL-10662 CVE-2021-3670 affecting package samba 4.12.5-7

MaxQueryDuration not honoured in Samba AD DC LDAP...

Sql injection

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder...

CVE-2022-33147

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder...

User Funds are Locked in the VotingEscrow Contract When Delegated User Withdraws

Lines of code Vulnerability details Description There exists an issue when a delegated user attempts to withdraw the locked funds after a lock duration is expired, as a result the funds for the original user who triggered the delegation is lost within the contract. Impact This is an issue because...

Problems with the access control of the fillOrder() function

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. fillOrder does not check order.maker ! = caller, which means that mintorder.maker, uint256orderHash; & mintmsg.sender, positionId; can mint NFT to the same person and therefore may create unintended...

OESA-2022-1735 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: MaxQueryDuration not honoured in Samba AD DC LDAPCVE-2021-3670...

The vulnerability of the Microsoft Office 365 software is related to incorrect session duration settings, which allows attackers to gain unauthorized access to protected information.

The vulnerability of the Microsoft Office 365 software package is related to incorrect session duration settings. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

NibblVault buyout duration longer than update timelock

Lines of code Vulnerability details Impact User can buy out NFT by initiating the process through initiateBuyout, then he has to wait BUYOUTDURATION which is 5 days and if the buyout will not get rejected he can claim the NFT. During that period bidder cannot cancel the process. The issue is that...