GHSA-HMX6-R76C-85G9 Gradio apps vulnerable to timing attacks to guess password

Impact This security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio app...

PT-2023-31953 · Gallery3D · Gallery 3

Name of the Vulnerable Software and Affected Versions: Gallery3d on Tecno Camon X CA7 devices affected versions not specified Description: The issue allows attackers to view hidden images by navigating to the data/com.android.gallery3d/.privatealbum/.encryptfiles directory and guessing the correc...

Timing Attack

generator-jhipster is vulnerable to a Timing Attack. The vulnerability exists because the TokenProvider.java uses String.equalsstr to compare the given token-signature. This comparison method does not effectively validate the token because it stops as soon as it encounters the first character tha...

CVE-2023-43699

Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited...

CVE-2023-24284

A crafted save file can cause a buffer overrun in the Guess puzzle...

CVE-2023-24283

A crafted save file can cause a buffer overrun in the Guess puzzle...

Oracle Linux 7 : cloud-init (ELSA-2020-3898)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3898 advisory. - Resolves: bz1574338 CVE-2018-10896 cloud-init: SSH host keys are not regenerated for the new instances rhel-7 - Resolves: bz1812170 CVE-2020-8632...

guess-works.com Cross Site Scripting vulnerability OBB-3537816

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Information disclosure

AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to information disclosure...

CVE-2023-34344 A vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username

AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to information disclosure...

SUSE CVE-2023-33546

Janino 3.1.9 and earlier are subject to denial of service DOS attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by...

janino vulnerable to denial of service due to stack overflow

janino 3.1.9 and earlier is subject to denial of service DOS attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow...

CVE-2023-33546

Janino 3.1.9 and earlier are subject to denial of service DOS attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by...

UBUNTU-CVE-2023-33546

DISPUTED Janino 3.1.9 and earlier are subject to denial of service DOS attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disput...

PT-2023-24378 · Janino +2 · Janino +2

Name of the Vulnerable Software and Affected Versions: Janino versions 3.1.9 and earlier Description: The issue allows for denial of service DOS attacks when using the evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes th...

PT-2023-19510 · Canonical +4 · Sgt-Puzzles

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A crafted save file can cause a buffer overrun in the Guess puzzle. There is no information available about the estimated number of potentially affected...

CVE-2023-24284

A crafted save file can cause a buffer overrun in the Guess puzzle...

UBUNTU-CVE-2023-24283

A crafted save file can cause a buffer overrun in the Guess puzzle...

CVE-2023-24283

A crafted save file can cause a buffer overrun in the Guess puzzle...

PT-2023-19511 · Canonical +4 · Sgt-Puzzles

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A crafted save file can cause a buffer overrun in the Guess puzzle. Recommendations: At the moment, there is no information about a newer version that...