Multisig's functionality is impaired when Signers#threshold is 1

Lines of code Vulnerability details Impact Multisig's functionality is impaired when Signersthreshold is 1. Imagine the Signersthreshold is 1, so an individual signer is possible claim all the funds from Multisig without the need for other signers to vote. It is logical that at least 2 people...

CVE-2021-34475

Microsoft Edge Chromium-based Elevation of Privilege Vulnerability...

CVE-2023-30592

Product / scope: Grav CMS (PHP, Grav

CVE-2023-30596

Summary: CVE-2023-30596 is a Grav CMS vulnerability (SSTI) in Grav

CVE-2020-22592

CVE-2020-22592 is associated with WebKitGTK in WebKitGTK/WebKit components. The connected advisories indicate a logic issue addressed with improved state management in WebKitGTK prior to version 2.38.5, and a separate use-after-free/memory-management cleanup fixed in later releases. Specifically,...

CVE-2022-32758

CVE-2022-32758 is listed in IBM’s Security Directory Suite bulletin as a vulnerability where a remote attacker could hijack the clicking action of a victim by guiding them to a malicious site. The affected product context is IBM Security Directory Server within IBM Security Directory Suite, with ...

GHSA-33HQ-F2MF-JM3C kyverno seccomp control can be circumvented

Impact Users of the podSecurity validate.podSecurity subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the...

CVE-2021-25569

CVE-2021-25569 is involved in IBM App Connect Enterprise (ACE) as part of a set of protobuf-java parsing flaws affecting ACE v11.x and v12.x (DFDL). Affected: ACE 12.0.1.0–12.0.8.0 and 11.0.0.1–11.0.0.20. Description in the connected doc indicates protobuf-java core and lite are vulnerable to den...

Future Exploitation Vector: File Extensions as Top-Level Domains

In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains TLDs while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards...

CVE-2023-2755

Technical details are not publicly available in the provided documents; the CVE entry is reserved and no affected products, impact, or remediation are disclosed. Monitor for updates.

CVE-2014-2912

The connected document describes an insecure tempfile usage in Ansible, where temporary file names are derived from the system time, enabling an attacker to guess the filename and potentially disclose sensitive information. No product versions, exact vulnerability scope, or patch details are prov...

CVE-2014-1865

The CVE-2014-1865 entry is supported by a Veracode advisory (VERACODE:4217) describing an information-disclosure vulnerability in fat_free_crm where password-related attributes — password_hash , password_salt , and password_confirmation — are not filtered from logs, exposing sensitive data to mal...

CVE-2014-1866

The connected VERACODE entry documents a vulnerability in fat_free_crm: Information leakage via error pages. The root cause is that consider_all_requests_local is set to true by default in production, causing 404 and 500 error pages to expose server setup information. The document does not provid...

CVE-2014-9086

The connected Veracode entry identifies a vulnerability in ImageMagick characterized as an information disclosure through a file descriptor leak caused by a corrupted file. Affected component: ImageMagick’s handling of file inputs may leak file descriptors, enabling exposure of sensitive data. Ro...

CVE-2014-1862

The connected document identifies a concrete issue in fat_free_crm: unauthorised new user signup due to users_controller not preventing account creation via crafted POST requests. This results in unapproved signups and potential misuse. The description does not provide a remediation. No other aff...

CVE-2018-9863

The CVE-2018-9863 entry concerns the express-useragent Node.js/ExpressJS middleware. The connected documents reveal a concrete vulnerability: lack of sanitization/escaping of the HTTP User-Agent header , which an attacker can exploit to trigger Cross-site Scripting (XSS) . Impact described across...

CVE-2018-12119

CVE-2018-12119 is a reserved candidate in Initial Description; connected data indicates a Cross-site Scripting (XSS) issue in knowledge_repo due to lack of sanitization of user-supplied parameters (e.g., comments) when rendering templates. The vulnerability is tied to knowledge_repo’s web renderi...

CVE-2017-12968

The connected document provides concrete details for CVE-2017-12968: libexiv2.so is vulnerable to a denial of service (DoS) via a heap-based buffer overflow. The vulnerability exists in basicio.cpp, causing an out-of-bounds write in Exiv2::Image::printIFDStructure. This information confirms the a...

CVE-2018-7646

The connected Veracode entry identifies a denial of service in svgexport caused by a missing timeout when loading an external image. Impact is DoS; no exploit details are provided in the supplied documents. No CVE-specific remediation is stated here; monitor for updates.

CVE-2018-19454

The connected document identifies a concrete vulnerability in yiisoft/yii2: information disclosure caused by credentials (e.g., HTTP auth username/password) being logged in the application’s logging target (\yii\log\Target). An attacker who can access the log files could retrieve these credential...