GSD-2023-1002035 fbcon: Check font dimension limits

fbcon: Check font dimension limits This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.93 by commit dccbd062d71657648efc32fdc9919b33763cc68b, ...

GSD-2023-1001869 fbcon: Check font dimension limits

fbcon: Check font dimension limits This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit 5e7f6e2ade57dfd6d133ff7c643abd2079248943, i...

The vulnerability of microprogramming software in programming-and-software-based monitoring and security infrastructure for IT infrastructure systems arises from the inability to effectively limit authentication attempts. This allows attackers to circumvent existing security restrictions by using brute-force attacks.

The vulnerability of the microprogramming software used in software-hardware environments for monitoring and security protection of IT infrastructure against physical threats in the NetBotz 4 system is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability...

Schneider Electric Conext ComBox 安全漏洞

Schneider Electric Conext ComBox is a powerful communication and monitoring device from Schneider Electric, a French company. A security vulnerability exists in all versions of the Schneider Electric Conext ComBox that stems from an incorrect limit on the number of authentication attempts that...

SUSE: Security Advisory (SUSE-SU-2023:0187-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2023-1674816097 grub2: Fix of 2 CVEs

font: Reject glyphs exceeds font-maxglyphwidth or font-maxglyph height - font: Fix size overflow in grubfontgetglyphinternal - CVE-2022-2601: font: Fix several integer overflows in grubfontconstructglyph - CVE-2022-3775: font: Fix an integer underflow in blitcomb...

SUSE-SU-2023:0187-1 Security update for podman

This update for podman fixes the following issues: podman was updated to version 4.3.1: 4.3.1: Bugfixes - Fixed a deadlock between the podman ps and podman container inspect commands Misc - Updated the containers/image library to v5.23.1 4.3.0: Features - A new command, podman generate spec, has...

PT-2023-18681 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta1 Description: Discourse is an open source platform for community discussion. The issue concerns the allocation of resources without limits, allowing users to create chat drafts of an unlimited length. Th...

Design/Logic Flaw

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in...

CVE-2023-22730 Improper Input Validation of Clearance sale in cart

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in...

CVE-2023-22730

CVE-2023-22730 affects Shopware (open source e-commerce platform based on Symfony and Vue.js). The vulnerability arises from allowing the same line item to be added multiple times in the cart via the API, bypassing quantity limits because Cart Validators did not properly enforce item individualit...

Shopware 输入验证错误漏洞

Shopware is a suite of open source e-commerce software from German company Shopware. Shopware suffers from an input validation error vulnerability that originates from the ability to use AP to place the same line item into the shopping cart multiple times. This allows users to bypass sales quanti...

Vim text editor’s build_stl_str_hl() function vulnerability, allowing an attacker to execute arbitrary code

The vulnerability of the buildstlstrhl function in the Vim text editor is related to the execution of an operation beyond the buffer’s memory limits. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2022-4119

The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

memos 安全漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in versions of memos prior to 0.9.1 that stems from an improper restriction on excessive authentication attempts...

GO-2022-1148 Resource exhaustion in github.com/libp2p/go-libp2p

go-libp2p is vulnerable to targeted resource exhaustion attacks. These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system. While a...

PT-2022-26039 · WordPress · Demon Image Annotation Plugin

Name of the Vulnerable Software and Affected Versions: demon image annotation plugin for WordPress versions up to, and including 5.0 Description: The issue arises from improper input validation in the plugin, specifically when handling the number of characters supplied during an annotation. Despi...

CVE-2022-3881

CVE-2022-3881 concerns the WordPress WPTools plugin, affected versions before 3.43. The issue is improper authorization and CSRF in an AJAX action, allowing any authenticated user (e.g., a subscriber) to install and activate arbitrary plugins from wordpress.org. Root cause: missing CSRF/authoriza...

An operator can bypass the withdrawal limits

Lines of code Vulnerability details Impact An operator can bypass the withdrawal limits if he withdraws when the lastUserPeriodReset + userPeriodLength or lastGlobalPeriodReset + globalPeriodLength is less than the block.timestamp. This causes a DOS as well since globalAmountWithdrawnThisPeriod...

limits are not correctly enforced in withdrawHook contract

Lines of code Vulnerability details Impact withdrawHook contract checks that inside a specified length of time only certain amount of withdrawal are possible per user and globally. But on every period reset the allowed withdraw limit check is missing. And a user can withdraw more that is allowed...