4150 matches found
GSD-2023-1002318 drm/amd/display: Adjust downscaling limits for dcn314
drm/amd/display: Adjust downscaling limits for dcn314 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...
PT-2023-35394
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.13 Description The issue is related to the adjustment of downscaling limits for dcn314 in the drm/amd/display component. The actual impact and attack plausibility have not yet been proven. Recommendations Fo...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: Stored XSS via Kroki diagram Prometheus integration Google IAP details are not hidden, may leak account details from instance/group/project settings Improper validation of SSO and SCIM tokens while managing groups Maintainer can leak Datadog API key by changing Datadog site...
CVE-2023-23916: Allocation of Resources Without Limits or Throttling
An allocation of resources without limits or throttling vulnerability exists in curl...
Denial Of Service (DoS)
kiwitcms is vulnerable to Denial Of Service DoS. The vulnerability exists because the library does not impose rate limits in forms.py, allowing an attacker to cause an application crash through the password reset page by sending a large number of emails if they know the user email addresses in Ki...
CVE-2022-31394: Allocation of Resources Without Limits or Throttling
Hyperium Hyper before 0.14.19 does not allow for customization of the maxheaderlistsize method in the H2 third-party software, allowing attackers to perform HTTP2 attacks...
CVE-2023-24998: Allocation of Resources Without Limits or Throttling
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option...
Nomad Client Vulnerable to Decompression Bombs in Artifact Block
Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a job submitted with a maliciously compressed source a.k.a “Zip Bomb” in an artifact stanza can cause excessive disk resource consumption, crashing a Nomad client agent. This vulnerability, CVE-2023-0821, was...
GHSA-7J9H-3JXF-3VRF Denial of service vulnerability on Password reset page
Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may...
CVE-2023-25156
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a...
SUSE CVE-2004-0003
Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking."...
SUSE CVE-2005-0179
Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service CPU and memory consumption and bypass RLIMMEMLOCK limits via the mlockall call...
SUSE CVE-2009-1100
Multiple unspecified vulnerabilities in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allow remote attackers to cause a denial of service disk consumption via vectors related to temporary font files and 1 "limits on Font...
SUSE CVE-2011-1681
vmware-hgfsmounter in VMware Open Virtual Machine Tools aka open-vm-tools 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process with a small...
SUSE CVE-2013-0306
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service memory consumption or trigger server errors via a modified maxnum parameter...
SUSE CVE-2013-4312
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service memory consumption by sending each descriptor over a UNIX socket before closing it, related to net/unix/afunix.c and net/unix/garbage.c...
SUSE CVE-2014-7960
OpenStack Object Storage Swift before 2.2.0 allows remote authenticated users to bypass the maxmetacount and other metadata constraints via multiple crafted requests which exceed the limit when combined...
SUSE CVE-2015-1420
Race condition in the handletopath function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handlebytes value of a file handle during the execution of this functio...
SUSE CVE-2015-3335
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandboxlinux/naclsandboxlinux.cc in Google Chrome before 42.0.2311.90 does not have RLIMITAS and RLIMITDATA limits for Native Client aka NaCl processes, which might make it easier for remote attackers to conduct...