Important: rust

Issue Overview: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitrevparsesingle can cause the function to enter an infinite loop, potentially...

CVE-2024-2467

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The...

BIT-SILVERSTRIPE-2020-25817

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

CVE-2024-24829 SSRF in Sentry via Phabricator integration

Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration maintained by Sentry with version =24.1.1 contains a constrained SSRF vulnerability. A...

CVE-2023-49254

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

CVE-2023-49254 Command injection in the network test tools

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

PT-2024-13711 · Hongdian · H8951-4G-Esp +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An authenticated user can execute arbitrary commands in the context of the root user by providing a payload in the destination field of the network test...

CVE-2024-22199 Django Template Engine Vulnerable to XSS

This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...

GHSA-C9V7-WMWJ-VF6X Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact An attacker that...

M-09 Unmitigated

Lines of code Vulnerability details Mitigation of M-09: Issue not mitigated Link to Issue: code-423n4/2023-09-asymmetry-findings31 Comments The sponsor has acknowledged the issue but decided to not mitigate it. Acknowledged and did not fix, plan to upgrade a fix in the future --- The text was...

H-02 Unmitigated

Lines of code Vulnerability details Mitigation of H-02: Issue mitigated with ERROR Mitigated issue H-02: Zero amount withdrawals of SafEth or Votium will brick the withdraw process The issue was that withdrawing afEth might imply a withdrawal of 0 safEth or vAfEth, which reverts. Mitigation revie...

H-01 Unmitigated

Lines of code Vulnerability details Mitigation of H-01: Issue NOT mitigated Mitigated issue H-01: Intrinsic arbitrage from price discrepancy The issue was that a price discrepancy between the exchange and oracle could be exploited within AfEth for an arbitrage. Mitigation review The maximum profi...

HP Print and Scan Doctor for Windows - Potential Escalation of Privilege

HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability. The fix applies to HP Print and Scan Doctor for Windows application, which will be launched via the HP Support Assistant...

Signed data may be usable cross-chain

Lines of code Vulnerability details Impact The function validatePreTransactionOverridable, which Validates a txn on guard before execution, for Brahma console accounts.takes one parameter "txParams" which is of type SafeTransactionParams Struct, if we look at that struct members : struct...

Open redirect

Rejected reason: This candidate is unused by its CNA...

bogbasen.dk Cross Site Scripting vulnerability OBB-3461581

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

AddToAny Share Buttons - Moderately critical - Access bypass - SA-CONTRIB-2023-018

This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when retrieving the label of an AddToAny block. This vulnerability is mitigated by the fact it requires the node ID to be passed via the route, requiring another module or specific...

Design/Logic Flaw

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

Mitigation of M-09: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-09: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings673 Even though the contest repository revision 431a4b751fb7e184b847a41509b97e4d67971d2f doesn't mention a changeset for M-09, I assume the...

Mitigation Confirmed for Mitigation of M-05: See comments

Mitigated issue M-05: Missing derivative limit and deposit availability checks will revert the whole stake function The issue was that stake calls deposit on each derivative without considering certain conditions under which some deposit might revert. There is an overlap between this issue and...