booth 授权问题漏洞

Both is an open source ticket manager from ClusterLabs. A security vulnerability exists in booth that stems from the authfile directive in the booth configuration file being ignored, preventing the use of authentication in node-to-node communication. As a result, a node without the correct...

There is no method to unignore any ignored pair.

Lines of code Vulnerability details Impact The Witch contract uses setIgnoredPair function to prevent the liquidation of accepted pairs on the governance level. However, there is no method to remove these pairs from the ignoredPairs mapping. Proof of Concept Imagine there are vaults with UST/fyUS...

Simple Page Transition <= 1.4.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the "Ignored Download Link...

Malicious code in ignored-package-pkg-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07140ab48c398b689d27001f76d16b46839594cbd92750306a11845acbbfb9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3791 Malicious code in ignored-package-pkg-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07140ab48c398b689d27001f76d16b46839594cbd92750306a11845acbbfb9d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NonCustodialPSM.mint ignores mint buffer reduced amount, mostly disabling mint rate control

Lines of code Vulnerability details Impact VOLT minting rate control doesn't happen when RateLimited's doPartialAction is true as NonCustodialPSM doesn't use the returned amount value, minting the full amount even when it was reduced by current mint buffer size limitation. There are two issues wi...

Wyze Camera Vulnerability

Wyze ignored a vulnerability in its home security cameras for three years. Bitdefender, who discovered the vulnerability, let the company get away with it. In case youre wondering, no, that is not normal in the security community. While experts tell me that the concept of a "responsible disclosur...

PT-2022-29106

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.104 Description The issue concerns the orig len parameter in the bpf, sockmap functionality. It has been noted that this parameter should not be ignored. The actual impact and potential for attack have not...

CVE-2021-45081

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS...

GitHub Security Lab: Java: An experimental query for ignored hostname verification

This bug was reported directly to GitHub Security Lab...

CVE-2021-4166

vim is vulnerable to Out-of-bounds Read...

Puppet 安全漏洞

Puppet is a set of configuration management tools based on the client/server C/S architecture from Puppet Labs in the United States, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Agent is a Puppet agent end-program. A security...

DEBIAN-CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

CVE-2021-22960

The parse function in llhttp 2.1.4 and 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS under certain conditions...

The vulnerability of the configuration comparison function of the software tool for interacting with servers via CURL, related to the use of a name with an incorrect reference, allows attackers to access confidential data.

The vulnerability of the configuration comparison function of the software tool for interacting with servers via CURL is related to the comparison of paths without considering registrations. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

vercel/serve allows access to restricted files if filename is URL encoded.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

GHSA-5RC4-8QQH-VQ7F vercel/serve allows access to restricted files if filename is URL encoded.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

CVE-2021-32700

Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored...

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...