DEBIAN-CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

PT-2022-24916 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.10 Nextcloud Server versions prior to 23.0.7 Nextcloud Server versions prior to 24.0.3 Description: The Nextcloud server is an open source personal cloud server. Affected versions of the Nextcloud serve...

Zero approval missing

Lines of code Vulnerability details Impact Frontrunning is possible where user withdraw money before setApproval refill the approval limit. This allows User to get more funds than required Proof of Concept 1. User A is approved an amount of 50 2. "custodian" decides to reduce the approval amount ...

RUSTSEC-2022-0055 No default limit put on request bodies

::fromrequest would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large or infinite body your server might run out of memory and crash. This also applies to these extractors which used Bytes::fromrequest internally: -...

No default limit put on request bodies

::fromrequest would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large or infinite body your server might run out of memory and crash. This also applies to these extractors which used Bytes::fromrequest internally: -...

GHSA-3MC7-4Q67-W48M Uncontrolled Resource Consumption in snakeyaml

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

PT-2022-21101 · Axum-Core +1 · Axum-Core +1

Name of the Vulnerable Software and Affected Versions: axum versions ::from request function not setting a limit for the size of the request body by default. This allows a malicious peer to send a very large or infinite body, potentially causing the server to run out of memory and crash. The...

GNU C Library 日志信息泄露漏洞

The GNU C Library glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A security vulnerability exists in GNU C Library glibc version 2.36, which stems from the fact that when the syslog function is passed a carefully crafted input string larger than 1024 byte...

Symmetricom SyncServer Unauthenticated Remote Command Execution

This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. The S100 through S350 End of Life models should be vulnerable to unauthenticated exploitation due to a session handling vulnerability. Later models require authentication which is not provided in this...

DEBIAN-CVE-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

CVE-2022-25857

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

SQL Injection

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to SQL Injection via the getbookmarks function. An attacker can manipulate SQL queries and potentially access or alter database information by injecting...

PT-2022-6923

Name of the Vulnerable Software and Affected Versions org.yaml:snakeyaml versions 0 through 1.30 Description The issue is related to a Denial of Service DoS vulnerability due to missing nested depth limitation for collections in the SnakeYAML library, which is used for serialization and...

No rate limit via proxy url parameter

Description Hi Drawio Team , Your proxy server has no limit of requests which an attacker can use it as PORT SCANNER. https://app.diagrams.net/proxy?url=IP:PORT&base64=1 Proof of Concept Image from my OWASP ZAP : https://ibb.co/h87hz3N...

CVE-2022-0480

A flaw was found in the filelockinit in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface POSIX file locks...

DDOS attack by uploading a few hundred large files

Description can normal user upload the photo to the profile not allowed photo more than 2 MB i can upload photo more allowed limit Proof of Concept https://drive.google.com/file/d/1jh0n9kOoFvW-esHgpOtPeURTYjSIhDm/view?usp=sharing...

WordPress plugin Limit Login Attempts Plus 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in WordPres...

WordPress plugin LOGIN AND REGISTRATION ATTEMPTS LIMIT 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

queue(), execute(), cancel() and veto() can run out of gas and revert due to out of bound loops

Lines of code Vulnerability details Impact The functions queue, execute, cancel and veto contain unbounded loops, which can cause transactions to consume more gas than the block limit run out of gas and revert. Since these functions are critical for the proposals flow, this could impact the...

WordPress plugin Limit Login Attempts 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in WordPres...