Rocky Linux 8 : ruby:3.1 (RLSA-2024:1431)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1431 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that...

After upgrading to 13.1 49.x build , the PE CPU significantly increases after running for some time

You may observe the following issues when you're running the below version 13.1 52.x/14.1 17.x and using hundreds of admin partitions: All newnslog files have a very small time range, for example, 1-5 seconds. nsconmsg -K newnslog -d setime start time Fri Sep 8 03:25:28 2023 end time Fri Sep 8...

CVE-2024-1765

Cloudflare Quiche through version 0.19.1/0.20.0 was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited numb...

CVE-2021-46914 ixgbe: fix unbalanced device enable/disable in suspend/resume

In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix unbalanced device enable/disable in suspend/resume pcidisabledevice called in ixgbeshutdown decreases dev-enablecnt by 1. pcienabledevicemem which increases dev-enablecnt by 1, was removed from ixgberesume in commit...

CVE-2024-1687 Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the gettexteditorcontent function in all versions up to, and including, 1.1.2. This makes it possible for authenticat...

CVE-2024-1686: Missing Authorization

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the applylayout function due to a missing capability check. This makes it possible for authenticated attackers, with...

Ransomware in 2023 recap: 5 key takeaways

This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...

CVE-2023-47792: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin = 2.1.1 versions...

DoS: Auction May Be Made Unusable By An Attacker

Lines of code Vulnerability details Impact When the items of auctionInfoData array is sufficiently high, claimAuction, cancelAllBids, returnHighestBid will all not be able to be called due to the block gas limit rendering all funds locked and auction unusable. auctionInfoData can only ever be add...

TRANSFERING FUNDS TO YOURSELF INCREASES YOUR BALANCE

Lines of code Vulnerability details Impact If transferred to yourself, it will cause your balance to increase, thus growing the token balance infinitely. Proof of Concept File: src/market/WildcatMarketToken.sol 54: transferfrom, to, amount; 74: accountsfrom = fromAccount; 78: accountsto =...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-40542

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP 资源管理错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A denial of service vulnerability exists in F5 BIG-IP, which can be exploited by attackers to cause an increase in memory...

M-04 MitigationConfirmed

Lines of code Vulnerability details In the previous implementation RewardableERC20claimAndSyncRewards rewardsPerShare += delta one / totalSupply; Some rewards might be locked inside the contract due to the rounding loss. Mitigation PR 896 Recalculated balanceAfterClaimingRewards to remove the...

open-vm-tools security update

11.0.5-3.0.1 - fix spaces in vmware udev rule for scsi devices Orabug: 24461968 - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. Orabug: 22815019 - Increase timeout for scsi devices on VMWare guests by adding a udev rule. - Created a new file 99-vmware-scsi-timeout.rules - Modified sp...

using increaseTotalStakeUncheckpointed() instead of increaseTotalStake() can lead to inconsistent transcoder state

Lines of code Vulnerability details Impact This allows a transcoder to increase their voting power without actually increasing their stake. Proof of Concept The relevant code that uses increaseTotalStakeUncheckpointed and skips transcoder state checkpointing is in the updateTranscoderWithRewards...