GSD-2022-1003811 bpf: Fix excessive memory allocation in stack_map_alloc()

bpf: Fix excessive memory allocation in stackmapalloc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003654 bpf: Fix excessive memory allocation in stack_map_alloc()

bpf: Fix excessive memory allocation in stackmapalloc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

CVE-2022-32205

A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive amounts of Set-Cookie: headers in an HTTP response to curl, which stores all of them. This flaw leads to a denial of service, either by mistake or by a malicious actor...

CURL-CVE-2022-32205 Set-Cookie denial of service

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the...

Internet Bug Bounty: CVE-2022-32205: Set-Cookie denial of service

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the...

CVE-2022-32205

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl 7.84.0 stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger th...

Design/Logic Flaw

A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives...

CVE-2021-46823

A flaw was found in python-ldap. The vulnerability occurs due to a regular expression and leads to a denial of service attack. This flaw allows an attacker to parse LDAP schema definitions from an untrusted source, leading to a crash or code execution. Mitigation Check input for an excessive amou...

VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing

The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a...

Memory corruption

OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation...

The NocoDB application allows large characters to insert in the input field "New Project" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

Proof of Concept Go to http://localhost:8080/dashboard//projects Click on New project and create Fill the "Enter project name" field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...

CVE-2022-31589

Due to improper authorization check, business users who are using Israeli File from SHAAM program /ATL/VQ23 transaction, are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted...

Upgraded Q -> H from 110 [1655009286368]

Judge has assessed an item in Issue 110 as High risk. The relevant finding follows: platformFee should be upper bounded to avoid DoS and excessive fees platformFee can take a value of 10000 100% which could be seen as a trust issue: File: RoyaltyVault.sol 67: function setPlatformFeeuint256...

CVE-2022-2037

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0...

CVE-2022-2037

CVE-2022-2037 affects ToolJet (tooljet/tooljet) before v1.16.0. The vulnerability is described as an Excessive Attack Surface. Severity varies by source (NVD CVSS2/3.1 reports base scores up to 8.0/9.8 in CNA data). A fix exists in v1.16.0 and later; upgrade to 1.16.0+ to mitigate. Technical deta...

CVE-2022-2037 Excessive Attack Surface in tooljet/tooljet

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0...

CVE-2022-2037 Excessive Attack Surface in tooljet/tooljet

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0...

RHEL 7 : java-1.7.1-ibm (RHSA-2022:4957)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4957 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IB...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

CVE-2022-30235

CVE-2022-30235 applies to Schneider Electric Wiser Smart and related EER21000/EER21001 devices (V4.5 and earlier). The vulnerability is CWE-307: Improper Restriction of Excessive Authentication Attempts, enabling brute‑force-style unauthorized access. The evidence indicates a network-based risk w...