11753 matches found
The vulnerability of the NDES registration service for Microsoft Windows operating systems allows a hacker to circumvent existing security restrictions and expose the protected information.
The vulnerability of the Network Device Registration Service NDES of Microsoft Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions and disclose sensitive information...
CVE-2022-23495
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode...
Input validation
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode...
CVE-2022-23495 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode...
CVE-2022-23495
CVE-2022-23495 concerns go-merkledag where a modified or decoded ProtoNode can be placed into an unencodeable form, causing encode errors that panic on calls that do not return errors. This behavior is tied to the DAGService/IPLD node handling and may be triggered by inputs using a non-validated ...
USN-5769-1 protobuf vulnerabilities
It was discovered that protobuf did not properly manage memory when serializing large messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2015-5237 It was discovered that...
GHSA-X39J-H85H-3F46 go-merkledag's ProtoNode may be modified such that common method calls may panic
Impact A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error fro...
go-merkledag's ProtoNode may be modified such that common method calls may panic
Impact A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error fro...
libxml2: dict corruption caused by entity reference cycles
A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...
The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability of the API interface of the Redfish microprogramming software for remote control controllers AMI MegaRAC allows a perpetrator to execute arbitrary code.
The vulnerability of the API interface of the microprogramming software for AMI MegaRAC controllers is related to errors during code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request...
The vulnerability of the Advanced Local Procedure Call (ALPC) handler in the Windows operating system allows attackers to enhance their privileges within the system.
The vulnerability of the Advanced Local Procedure Call ALPC in the Windows operating system arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges within the system...
The vulnerability in the web interface of the Cisco DNA Center allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Cisco DNA Center’s web interface is related to errors in processing requests. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information by sending specially crafted requests...
Upgraded Q -> M from #373 [1670018401792]
Judge has assessed an item in Issue 373 as M risk. The relevant finding follows: N2. ETH not accumulated in previewAccumulatedETH supposed to have accumulated += ... Although it is an external view function, depending on its usages, it may present more issues to the callers. --- The text was...
The vulnerability of the command interpreter in Moxa EDR-810, EDR-G902, EDR-G903, TN-4900, and TN-5916 router microprogramming devices allows attackers to execute arbitrary code.
The vulnerability of the command interpreter in Moxa EDR-810, EDR-G902, EDR-G903, TN-4900, and TN-5916 microprogrammed service routers stems from errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HTTP/HTT...
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key potentially leading to subsequent logic errors. In one case a double-free can be provoked.
...
The vulnerability of the Advanced Local Procedure Call (ALPC) handler in Microsoft Windows operating systems allows attackers to enhance their privileges.
The vulnerability of the Advanced Local Procedure Call ALPC in Microsoft Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...
The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt, related to errors in the certificate validation process, allows a perpetrator to carry out a “man-in-the-middle” attack.
The vulnerability of the configuration management system and the remote execution of operations in SaltStack Salt is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
The vulnerability of microprogramming software on Moxa computing platforms of the UC-8100A-ME-T, UC-2100, UC-2100-W, UC-3100, UC-5100, UC-8100, UC-8100-ME-T, UC-8200, UC-8410A, UC-8580, and UC-8540 models is related to errors in privilege management. This vulnerability allows a malicious entity to elevate their privileges.
The vulnerability of the microprogramming software on Moxa’s computing platforms series UC-8100A-ME-T, UC-2100, UC-2100-W, UC-3100, UC-5100, UC-8100, UC-8100-ME-T, UC-8200, UC-8410A, UC-8580, and UC-8540 IIoT gateways is related to privilege management errors. Exploiting this vulnerability can...
The vulnerability of the MODBUS protocol implementation in Tofino Xenon Security Appliance, Tofino Argon Security Appliance, and EAGLE 20 Tofino allows attackers to circumvent existing security restrictions.
The vulnerability of the MODBUS protocol implementation in Tofino Xenon Security Appliance, Tofino Argon Security Appliance, and EAGLE 20 Tofino lies in security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions using specially...