8885 matches found
Malicious user can use previously used nodeID to prevent user(s) from withdrawing minipool funds
Lines of code Vulnerability details In createMinipool, an event is emitted with details of a newly created minipool. This includes relevant information that a subsequent user can utilise to create another minipool.The only condition that prevents a minipool from being created again with the same...
Notice Of Change Announcement for NetScaler (Citrix ADC) Perpetually Licensed Hardware and Software
Applicable Products NetScaler Citrix ADC perpetually licensed hardware MPX, SDX and software VPX/BLX, & Standard Edition across all NetScaler Citrix ADC products. Information NetScaler, a business unit of Cloud Software Group, has made the decision to end of sale EoS NetScaler Citrix ADC...
The owner minipool count is not decreased in the case of a staking error
Lines of code Vulnerability details Impact When a node operator creates a new pool or the recreateMinipool function is called the minipool count of the owner is increased by 1 and when the staking ends the multisig calls the recordStakingEnd function which will decrease the owner minipool count b...
CVE-2022-40711
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users...
CVE-2022-40711
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users...
Cross site scripting
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users...
CVE-2022-40711
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users...
PT-2023-13896 · Primekey · Primekey Ejbca
Name of the Vulnerable Software and Affected Versions: PrimeKey EJBCA version 7.9.0.2 Community Description: The issue allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users. Recommendations: For PrimeKey EJBCA...
CVE-2022-40711
PrimeKey EJBCA 7.9.0.2 Community is affected by CVE-2022-40711, a stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload targeting higher-privilege users. Public remediations/patch version not specified in the provided sources. Exploitation details a...
CVE-2022-40711
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users...
GHSA-GVFJ-FXX3-J323 mellium.im/sasl authentication failure due to insufficient nonce randomness
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...
OESA-2022-2147 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In l2capchanput of l2capcore, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2022-47938
A denial-of-service flaw was found in the Linux Kernel while handling SMB2TREECONNECT commands in CIFS Filesystem. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerabilit...
Synology Router Manager (SRM) End of Life (EOL) Detection
The Synology Router Manager SRM version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Download Manager < 3.2.62 - Contributor+ Stored XSS
The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. 1. “Enable modal login form” option in the...
Google Takes Gmail Security to the Next Level with Client-Side Encryption
Google on Friday announced that its client-side encryption for Gmail is in beta for Workspace and education customers as part of its efforts to secure emails sent using the web version of the platform. The development comes at a time when concerns about online privacy and data security are at an...
Green End SFTP Server 安全漏洞
Green End SFTP Server is an SFTP server supporting protocol version 6 by Richard Kettlewell, an individual developer. A security vulnerability exists in Green End SFTP Server that stems from an uninitialized pointer due to the sftpparsepath function in its parse.c file...
December 13, 2022—KB5021291 (Monthly Rollup)
None None...