Duncaen OpenDoas 安全漏洞

Duncaen OpenDoas is a program from the individual developer Duncaen that provides limited Sudo functionality for Linux systems. A security vulnerability exists in OpenDoas 6.8.2 and earlier versions, which stems from sharing a terminal with the original session, and can be exploited by an attacke...

GHSA-66M4-GC8H-HPJX Timing attack in eZ Platform Ibexa

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

New BlackSnake Ransomware Performs Clipper Operations on Cryptocurrency Users

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackSnake ransomware has been discovered with clipper functionality that intercepts and replaces the cryptocurrency wallet addresses of victims with those of attacke...

Sensitive Information Disclosure

directus is vulnerable to Sensitive Information Disclosure. The vulnerability exists because users with read access to the password field in directususers can extract the argon2 password hashes by brute-forcing the export functionality combined with a startswith filter, which allows an attacker t...

Gas griefing is possible on unsafe external calls on execute

Lines of code Vulnerability details Impact A malicious or compromised actor that has EXECUTIONPERMISSIONID may cause a gas griefing attack by returning actionsi.data with a really high payload. Griefing attacks have no economic incentive for the attacker but could lead to other issues e.g. not...

GHSA-M5Q3-8WGF-X8XF Directus vulnerable to extraction of password hashes through export querying

Impact Users with read access to the password field in directususers can extract the argon2 password hashes by brute forcing the export functionality combined with a startswith filter. This allows the user to enumerate the password hashes. Patches The problem has been patched by preventing any...

Directus vulnerable to extraction of password hashes through export querying

Impact Users with read access to the password field in directususers can extract the argon2 password hashes by brute forcing the export functionality combined with a startswith filter. This allows the user to enumerate the password hashes. Patches The problem has been patched by preventing any...

CVE-2015-10087

CVE-2015-10087 affects UpThemes Theme DesignFolio Plus version 1.2 for WordPress. The vulnerability is an unrestricted file upload in an unknown functionality, exploitable remotely with no user interaction, and is disclosed publicly. The patch identifier 53f6ae62878076f99718e5feb589928e83c879a9 i...

GHSA-J9CW-5CPJ-9QJ5 Moodle has a Hidden Functionality vulnerability

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk...

Moodle has a Hidden Functionality vulnerability

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk...

GHSA-5GP5-VXJ6-4257 OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability

A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images...

Amazon Linux 2 : curl (ALAS-2023-1986)

The version of curl installed on the remote host is prior to 7.88.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1986 advisory. A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the sam...

LUSDT non-compliance with the EIP-2612 standard

Lines of code Vulnerability details Impact Inability to integrate LUSDT into contracts of other services where the DOMAINSEPARATOR is used or strict adherence to the EIP2612 standard is required. Various network analyzers that automatically determine the type of contracts will not be able to...

CVE-2023-26487 Vega has cross-site scripting vulnerability in `lassoAppend` function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.lassoAppend' function accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as push call argument...

CVE-2023-26047

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...

CVE-2023-26047 teler-waf contains detection rule bypass via entities payload

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...

workspace cannot find a valid smart card certificate

Workspace App gives error " cannot find a valid smart card certificate". This works via Browser but not via Workspace App...

CVE-2023-20014

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a...

Race condition

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5891-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5891-1 advisory. Harry Sintonen discovered that curl incorrectly handled HSTS support when multiple URLs are requested serially. A remote attacker...