3205 matches found
CVE-2023-4214
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit...
WordPress Plugin AppPresser Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
jetty: hpack header values cause denial of service in http/2
A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the trueMetaDataBuilder.checkSize, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service Do...
Deposit into strategy could be blocked by limits in EigenLayer
Lines of code Vulnerability details Summary The implementation of depositAssetIntoStrategy deposits the entire balance of the node delegator which could conflict with the max limits per deposit defined in EigenLayer. Impact NodeDelegator are responsible for managing assets in EigenLayer. The...
PT-2023-18421 · Intel +1 · Intel Qat Library +1
Name of the Vulnerable Software and Affected Versions: IntelR QAT Library versions prior to 22.07.1 Description: The issue is related to improper buffer restrictions, which may allow a privileged user to potentially enable information disclosure via local access. Recommendations: For versions pri...
CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
UBUNTU-CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
The vulnerability of the list_courses() function in the LearnPress plugin of the WordPress content management system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the listcourses function in the LearnPress plugin of the WordPress content management system is related to deficiencies in the path name limitation for accessing the restricted catalog. This issue affects the processing of $templatepaginationpath, $templatepath, and...
PT-2023-32169 · Moodle +7 · Moodle +3
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves the need for stronger revision number limitations on file serving endpoints to enhance cache poisoning protection. This is a measure ...
mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements
MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...
Rocky Linux 8 : brotli (RLSA-2021:1702)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1702 advisory. - A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a one-shot decompression request to a...
The vulnerability in the interaction interface with the Aria2 file downloader’s WebUI-Aria2 lies in the incorrect limitation of the path name for the restricted access directory. This allows a perpetrator to disclose protected information.
The vulnerability in the interaction interface with the Aria2 file downloader’s WebUI-Aria2 relates to an incorrect limitation on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to disclose the protected information...
Limits on mint and redeem per block of USDe will lead to paralysis
Lines of code Vulnerability details Impact Since the number of mint and redeem per block is limited, attackers can use scripts to squeeze out the quota with their own addresses. Thena cannot determine whether it is a normal user address or an attack address, causing the contract to be paralyzed. ...
RabbitMQ Resource Management Error Vulnerability
RabbitMQ is a feature-rich multi-protocol messaging and streaming agent from RabbitMQ open source. RabbitMQ has a security vulnerability that stems from the HTTP API does not enforce HTTP request body restrictions and is vulnerable to denial of service DoS attacks with oversized messages...
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
Impact The length of URIs and the various parts eg path segments, query parameters is usually limited by the webserver processing the incoming request. In the case of Puma the defaults are : - path segment length: 8192 - Max URI length: 1024 12 - Max query length: 1024 10 See...
GHSA-3PX7-JM2P-6H2C encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
Impact The length of URIs and the various parts eg path segments, query parameters is usually limited by the webserver processing the incoming request. In the case of Puma the defaults are : - path segment length: 8192 - Max URI length: 1024 12 - Max query length: 1024 10 See...
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
Impact The length of URIs and the various parts eg path segments, query parameters is usually limited by the webserver processing the incoming request. In the case of Puma the defaults are : - path segment length: 8192 - Max URI length: 1024 12 - Max query length: 1024 10 See...
CVE-2023-27152
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication...
CVE-2023-27152
CVE-2023-27152 affects DECISO OPNsense 23.1 and is caused by not imposing rate limits on authentication, enabling brute‑force attempts to bypass authentication. Attack vector: network; impact: high confidentiality, integrity, and availability. No remediation details are provided in the supplied d...
