The vulnerability of the initDocumentParser function in the Terracotta Quartz Scheduler library, which allows a hacker to execute an XXE attack

The vulnerability of the initDocumentParser function in the Terracotta Quartz Scheduler’s task scheduling library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute an XXE attack...

The vulnerability of the microprogramming software used in access control systems for the NetScaler Gateway virtual environment and the Citrix NetScaler Application Delivery Controller lies in the improper name restrictions on the path to the restricted directory. This allows attackers to gain access to published applications and carry out attacks from the Citrix server to other resources within the attacked company’s internal network.

The vulnerability of the microprogramming software used in access control systems for the NetScaler Gateway virtual environment, as well as the microprogramming software used in the Citrix NetScaler Application Delivery Controller, exists due to an incorrect limitation on the path name to the...

The vulnerability of theEncodeImage function in the GraphicsMagick graphics editor allows for reading beyond the allowed buffer data limits. This enables attackers to access confidential data and cause service interruptions.

The vulnerability of theEncodeImage function in the GraphicsMagick graphics editor involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information and compromise its integrity and accessibility...

CVE-2020-10732

A flaw was found in the Linux kernel’s implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data. Mitigation Possible mitigation would be to disable core dumps system-wide by setting: hard core 0 In the...

Code injection

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute...

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

A flaw was found in Netty in the way it handles the amount of data it compresses and decompresses. The Compression/Decompression codecs should enforce memory allocation size limits to avoid an Out of Memory Error OOME or exhaustion of the memory pool...

LDAP Denial of Service (stack overflow) in

Description LDAP is encoded as ASN.1, and LDAP filters are defined recursively as Filter ::= CHOICE and 0 SET OF Filter, or 1 SET OF Filter, not 2 Filter, This recursion is mirrored in Samba's recursive decent parser, which consumes around 600 bytes of stack per filter sent by the client. In Samb...

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

A flaw was found in Netty in the way it handles the amount of data it compresses and decompresses. The Compression/Decompression codecs should enforce memory allocation size limits to avoid an Out of Memory Error OOME or exhaustion of the memory pool...

The vulnerability of the Skia component in Google Chrome browsers, related to reading beyond the allowed buffer data limits, allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Skia component in Google Chrome browser relates to reading data beyond the allowed buffer limits. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause a service failure through a specially crafted web page...

The vulnerability of the `exif_read_data` function in the PHP programming language involves an operation that goes beyond the permissible buffer size limits. This allows attackers to gain unauthorized access to information or cause service failures.

The vulnerability of the exifreaddata function in the PHP programming language is related to the execution of operations that exceed the permissible buffer limits. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information or cause service failures...

The vulnerability of SQLite’s data processing mechanism in Google Chrome browsers allows attackers to gain unauthorized access to confidential data.

The vulnerability of SQLite data processing mechanism in Google Chrome browsers is related to reading data from buffer files beyond their allowable limits. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data through a created HTML page...

Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.

Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...

Insecure Resource Limit Verification

samba does not properly verify resource limits. It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cif...

The vulnerability of the ANGLE component in the Google Chrome web browser allows a perpetrator to compromise data integrity, cause service failures, or gain unauthorized access to confidential information.

The vulnerability of the ANGLE browser component in Google Chrome relates to the execution of operations within the data buffer’s allowable limits. Exploiting this vulnerability could allow an attacker to compromise data integrity, cause service failures, or gain unauthorized access to confidenti...

Authentication flaw

An issue was discovered in iXsystems FreeNAS and TrueNAS 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent...

Unspecified Vulnerability in Google Chrome (CNVD-2020-38211)

Google Chrome is a web browser from Google, an American company. An unspecified vulnerability exists in Google Chrome, which stems from the program not fully enforcing policies. An attacker can exploit this vulnerability to bypass navigation restrictions with the help of specially crafted HTML...

CVE-2020-7219

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. Mitigation Enforce network connection limits on Consul server agents by using the following iptables rule: iptables -A...

CVE-2016-8910

The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...

VMware Carbon Black Removes Endpoint Limits for Customers to Secure Their Changing Environments During the COVID-19 Crisis

Novel Coronavirus COVID-19 has thrust personal safety and security into the public’s consciousness in an unprecedented way. Families, employees, and global businesses have been forced to upend their lives to make their respective communities healthier and more resilient. A key component to this...

PT-2020-20203 · Kubernetes +1 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.15.0 through 1.15.9 Kubernetes versions 1.16.0 through 1.16.6 Kubernetes versions 1.17.0 through 1.17.2 Description: The Kubelet component has been found to be vulnerable to a denial of service attack via the kubelet API...