mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...

PT-2022-22936 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager versions 6.1 through 6.2 IBM Sterling Partner Engagement Manager Cloud version 22.2 Description: The issue is related to the lack of connection length limitation, which could cause the server to become...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

limits_.sum is not increased yet when performing limit check. Collateral may exceed the limit.

Lines of code Vulnerability details Impact limits.sum is not increased yet when performing limit check. Collateral may exceed the limit. There is a limit on how much collateral can be concurrently put at auction, but it is a soft limit. If the limit has been surpassed, no more vaults of that...

Mattermost Default Configuration Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a default configuration error that could be exploited by an attacker to bypass some existing rate limits or to use a manipulated IP for audit logging by manipulating the request header...

PT-2022-16169 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.7.0 and earlier Description: The issue is related to an incorrect default configuration for the trusted IP header, which allows an attacker to bypass some rate limitations or use manipulated IPs for audit logging by...

4 ways businesses can save money on cyber insurance

So, your business has just suffered a data breach and it’s time to dig deep in your pockets to pay all the resulting expenses. Without cyber insurance, you can expect to pay a dizzying amount of cash. In 2022 alone, the average cost of a data breach for businesses under 1,000 employees was close ...

glFTPd security vulnerability

glFTPd is a free FTP server for UNIX based systems from Team glFTPd. A security vulnerability exists in glFTPd version 2.11a. A remote attacker could exploit this vulnerability to cause a denial of service by exceeding connection limits...

EFB Tampering. Holdover Time

TL;DR Holdover applications are a relatively new method of calculating the effectiveness of anti-icing fluid sprayed onto aircraft wings. Applications such as these have additional attack surfaces as the developer and source databases need to be considered Airlines often view limits as targets to...

CODESYS buffer error vulnerability

CODESYS is a controller development system from Germany's 3S-Smart Software Solutions. A buffer error vulnerability exists in several CODESYS products and stems from a lack of internal buffer read limits in the application. An attacker can exploit this vulnerability to craft a request with an...

MAL-2022-381 Malicious code in @kindred-feature/deposit-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf347d02beec3a3d13a86271815398239c952e9304c9a1caa86b9c53fac99e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2134: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0...

CVE-2022-2134

Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0...

Malicious relayer could exploit sponsor vaults

Lines of code Vulnerability details Impact Sponsor vaults drained Proof of Concept reimburseRelayerFees uses SponsorVault funds to repay users the fees they pay to relayers. A malicious relayer could create a large number of transactions with the max reimbursed relay fee specified in SponsorVault...

GitLab < 14.8.6, 14.9.x < 14.9.4, 14.10.x < 14.10.1 DoS Vulnerability

GitLab is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; if...

CVE-2022-32559: Allocation of Resources Without Limits or Throttling

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics...

CVE-2022-31285: Allocation of Resources Without Limits or Throttling

An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h...

GHSA-FQX3-R75H-VC89 Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP

Impact Due to a workaround for unmapped network items implemented in 4.0.0-BETA5 8ac16345a3bc099b62c1f5cfbf3b736e621c3f76, arbitrary item IDs are able to be written into an item's NBT. The intended purpose of this is to make said unmapped network items able to be moved around the inventory withou...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...