BIT-DJANGO-2022-22818

The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...

BIT-GOLANG-2023-39326 Denial of service via chunk extensions in net/http

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data up to about...

BIT-GRAFANA-2023-4399

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the...

Denial Of Service

libheif.so is vulnerable to Denial Of Service. The vulnerability is due to improper handling of memory resources during the encoding process, allowing an attacker to trigger a denial of service attack...

SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2024:0728-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0728-1 advisory. Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack timing variant of the Bleichenbacher attack again...

Squid 安全漏洞

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A denial of service vulnerability exists in Squid that stems from the presence of a recursion error, which can be...

HTTP Request Smuggling

Modern web applications are often deployed with a chain of HTTP servers which ensure the transmission of the HTTP traffic from users to the service. Typical deployments include the usage of a front-end server, usually a load balancer or a reverse proxy, which will then transmit the requests to on...

Important: docker

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

RHEL 9 : skopeo (RHSA-2024:1149)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1149 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify file...

Insecure Deserialization

Dataease is vulnerable to Insecure Deserialization. The vulnerability is due not considering URL encoding while blacklisting certain user-controllable jdbc parameters in the JDBC connection url while calling methods getExtraParams and URLDecoder.decodegetExtraParams within Mysql.java. An attacker...

PT-2024-3055

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.17.7 Description The issue is related to a memory leak in the JpegEncoder::Encode function, which can be exploited by an attacker to cause a denial of service attack. This flaw allows a remote attacker to disrupt...

openSUSE: Security Advisory for apr (SUSE-SU-2023:0389-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-23492

A weak encoding is used to transmit credentials for WS203VICM...

Code injection

A weak encoding is used to transmit credentials for WS203VICM...

CVE-2024-23492 Commend WS203VICM Weak Encoding for Password

A weak encoding is used to transmit credentials for WS203VICM...

CVE-2024-23492 Commend WS203VICM Weak Encoding for Password

A weak encoding is used to transmit credentials for WS203VICM...

CVE-2024-23492

CVE-2024-23492 affects Commend WS203VICM video door stations (versions 1.7 and prior). The vulnerability is described as using a weak encoding to transmit credentials (WEAK ENCODING FOR PASSWORD CWE-261). Public documents also discuss related issues for the same device: argument injection and imp...

PT-2024-19897 · Ws203Vicm · Ws203Vicm

Name of the Vulnerable Software and Affected Versions: WS203VICM affected versions not specified Description: A weak encoding is used to transmit credentials. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Commend WS203VICM Parameter Injection Vulnerability

The Commend WS203VICM is a vandalism prevention station with a camera and call button from Commend. A parameter injection vulnerability exists in the Commend WS203VICM that originates from weakly encoding credentials used to transmit the WS203VICM...

GHSA-9VX6-7XXF-X967 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Impact The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. Although the encode function pads the output for these cases, up to 4 bits o...