PT-2023-31485 · Unknown · Spider-Flow

Name of the Vulnerable Software and Affected Versions: spider-flow versions up to 0.5.0 Description: A critical issue has been found, affecting the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.java in the API component. This issue...

spider-flow code issue vulnerability

spider-flow is a crawler platform open source by sssssssss-team. Spider-flow 0.5.0 previous version of a code problem vulnerability , the vulnerability stems from the component API file src/main/java/org/spiderflow/controller/DataSourceController.java in the DriverManager. There is an unknown...

Authentication flaw

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without...

No gas payment is done before calling the callContract in the Router.sol

Lines of code Vulnerability details Impact In the Axelar documentation it is specified that before calling callContract or callContractWithToken the user needs to first prepay the relayers gas fee on the source chain, but since the functions are not payable, nor does call...

CVE-2023-4039

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

Design/Logic Flaw

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-4039

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-4918

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are abl...

CVE-2023-4918

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are abl...

CVE-2023-4918 Plaintext storage of user password

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are abl...

CVE-2023-4918

The CVE-2023-4918 entry concerns Keycloak (org.keycloak.userprofile) where password and password-confirm fields submitted during self-registration become regular user attributes. The described flaw allows any user with proper rights to read user attributes and retrieve passwords in clear text, po...

There is a potential vulnerability with the nonce not incrementing as expected if there is an error or revert during the seaport flow

Lines of code Vulnerability details Impact This would allow the attacker to reuse the same nonce in multiple seaport transactions by reverting the first transaction after processNonce increments the stored nonce. Proof of Concept There is a potential issue with the nonce not incrementing as...

OESA-2023-1609 hyperscan security update

Hyperscan is a high-performance multiple regex matching library. It follows the regular expression syntax of the commonly-used libpcre library, but is a standalone library with its own C API. Security Fixes: Insufficient control flow management in the Hyperscan Library maintained by IntelR before...

Incorrect Control Flow Implementation

Electron is vulnerable to Incorrect Control Flow Implementation. The vulnerability is caused by not respecting a Content-Security-Policy CSP in renderers that have sandbox disabled i.e: sandbox:false. This can result in usage of methods like eval and new Function unexpectedly which can result in ...

Oracle Linux 8 : wavpack (ELSA-2020-1581)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1581 advisory. - CVE-2018-19841 - CVE-2019-1010317 - CVE-2019-1010315 - CVE-2019-11498 - CVE-2018-19840 Tenable has extracted the preceding description block directly...

URL Redirection To Untrusted Site ('Open Redirect')

jupyter-server is vulnerable to open redirect vulnerability. The vulnerability occurs due to not validating the redirect urls generated as part of the login flow. An attacker can trick a user into clicking a login link to jupyter server which includes malicious url redirect...

GHSA-VMF9-6PCV-XR87 Withdrawn Advisory: Username enumeration attack in goauthentik

Withdrawn Advisory This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references. Original Description Summary Using a recovery flow with an identification stage an attacker is able to determine if a username exists. Impact Onl...

Withdrawn Advisory: Username enumeration attack in goauthentik

Withdrawn Advisory This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references. Original Description Summary Using a recovery flow with an identification stage an attacker is able to determine if a username exists. Impact Onl...

Design/Logic Flaw

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522

goauthentik (open‑source Identity Provider) contains a vulnerability in affected versions using a recovery flow with an identification stage that allows an attacker to determine whether a username exists, enabling username/email enumeration. The issue affects setups with the recovery flow and can...