207 matches found
1Panel's password verification is suspected to have a timing attack vulnerability
Summary 源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 hmac.Equal 比对密码。 Translation: The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac...
equalreality.com Cross Site Scripting vulnerability OBB-3898473
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
A Self-Enforcing Protocol to Solve Gerrymandering
In 2009, I wrote: There are several ways two people can divide a piece of cake in half. One way is to find someone impartial to do it for them. This works, but it requires another person. Another way is for one person to divide the piece, and the other person to complain to the police, a judge, o...
kernel: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in updateparentsubpartscpumask It was found that the check to see if a partition could use up all the cpus from the parent cpuset in updateparentsubpartscpumask was incorrect. As a result, it is...
DEBIAN-CVE-2023-48951
An issue in the boxequal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS after running a SELECT statement...
UBUNTU-CVE-2023-48951
An issue in the boxequal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS after running a SELECT statement...
CVE-2023-48951
An issue in the boxequal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS after running a SELECT statement...
PT-2023-8879 · Unknown +4 · Virtuoso-Opensource +4
Name of the Vulnerable Software and Affected Versions: virtuoso-opensource version 7.2.11 Description: The issue is related to the box equal function in virtuoso-opensource, which can be exploited by attackers to cause a Denial of Service DoS after running a SELECT statement. The vulnerability is...
UBUNTU-CVE-2023-39352
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values rect-left and rect-top are exactly equal to surface-width and...
Upgraded Q -> 2 from #878 [1683053122687]
Judge has assessed an item in Issue 878 as 2 risk. The relevant finding follows: L-2 Royalties are paid assuming all NFTs in the batch are equally priced - --- The text was updated successfully, but these errors were encountered: All reactions...
GovernorCompatibilityBravo may trim proposal calldata
Impact The proposal creation entrypoint propose in GovernorCompatibilityBravo allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would...
Incorrect Calculation
github.com/FiloSottile/nistec is vulnerable to Incorrect Calculation. The vulnerability exists because the p256ordinv and p256asm functions do not return the correct value if the two input values are equal...
SUSE CVE-2006-6107
Unspecified vulnerability in the matchruleequal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service lost process messages...
Rapid7 Recognized on Bloomberg Gender Equality Index, Continues Commitments to Support DEI
For the fifth year in a row, Rapid7 is pleased to share that we've been included in the Bloomberg Gender Equality Index. The Gender Equality Index GEI recognizes publicly traded companies for being transparent in their commitment to gender equality. This includes how they score in areas such as...
CVE-2023-22399
When sFlow is enabled and it monitors a packet forwarded via ECMP, a buffer management vulnerability in the dcpfe process of Juniper Networks Junos OS on QFX10K Series systems allows an attacker to cause the Packet Forwarding Engine PFE to crash and restart by sending specific genuine packets to...
`CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in Tensorflow
...
Updated cifs-utils packages fix security vulnerability
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. CVE-2022-27239 cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign...
OESA-2022-1626 cifs-utils security update
The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. The in-kernel CIFS filesystem relies on a set of user-space tools. That package of tools is called cifs-utils.Although not really part of Samba proper, these tools were originally part of the...