Regular Expression Denial Of Service (ReDoS)

get-func-name is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to the getFuncName function in index.js not properly checking the functionSource size and length. which allows an attacker to trigger a DOS attack by using an input like '\t'.repeat54773 + '\t/function/i...

Denial Of Service (DOS)

io.undertow: undertow-servlet is vulnerable to Denial Of Service DOS. The vulnerability is caused by excessive memory consumption due to large multipart content upload handling resulting in OutOfMemoryError while processing @MultipartConfig annotated servlets. This can allow unauthorized users to...

function 'accrueInterest(address vToken)' allows too many rewards to be allocated

Lines of code Vulnerability details Impact Malicious users can increase the number of rewards they receive within a block. Proof of Concept In the Prime contract, marketsvToken.rewardIndex is used to determine how many rewards are allocated to Prime token holders, and its value can only be change...

Gas Limit Issues/DoS with Block Gas Limit

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Iterating through the users array without a limitation might cause the function to consume a lot of gas, especially when the array size is large. It may potentially reach the block gas limit and get...

Ubuntu 16.04 ESM / 18.04 ESM : GNU binutils vulnerabilities (USN-6413-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6413-1 advisory. It was discovered that GNU binutils was not properly performing checks when dealing with memory allocation operations, which could lead to...

CVE-2023-26151

Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service DoS such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory...

Design/Logic Flaw

In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets...

Mageia: Security Advisory (MGASA-2023-0273)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 37 : rust-axum / rust-tokio-tungstenite / rust-tungstenite / rust-warp (2023-e72bf7b92e)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-e72bf7b92e advisory. - Update the axum crate to version 0.6.20. - Update the tokio-tungstenite crate to version 0.20.1. - Update the tungstenite crate to version 0.20.1. - Port...

Fedora 38 : gdb (2023-d94be55511)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d94be55511 advisory. Security fix for CVE-2022-48064 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

SUSE SLED15: binutils / binutils-devel / binutils-devel-32bit / binutils-gold / etc (SUSE-SU-2023:3825-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3825-1 advisory. Update to version 2.41 jscPED-5778: The MIPS port now supports the Sony Interactive Entertainmen...

Chaijs/get-func-name vulnerable to ReDoS

The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows: js const functionNameMatch = /\sfunction?:\s|\s/^?:/+\/\s^\s/+/; This vulnerability can be exploited...

CVE-2023-5192

Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0...

pimcore Security Vulnerabilities

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in pimcore dem...

CVE-2023-5192

Affected software: pimcore/demo (prior to 10.3.0). Vulnerability: excessive data query operations in a large data table, with an additional risk from GraphQL introspection exposure on the demo site (demo.pimcore.fun). Root cause: not explicitly detailed beyond the symptom (excessive queries) and ...

PT-2023-31900 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/demo versions prior to 10.3.0 Description: The issue concerns excessive data query operations in a large data table. Additionally, introspection is enabled on the demo site demo.pimcore.fun, which allows users to run introspection...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2023-26141

A denial of service vulnerability was found in Sidekiq. This flaw allows an attacker to manipulate the localStorage value in the dashboard-charts.js file and cause excessive polling requests...

ROS-20230913-02

Nextcloud server vulnerability is related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to access files within a subfolder of an accessible group folder, even if extended permissions block access to the subfolder. of a group folder, even if...

CVE-2023-26141

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service DoS due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests...