3382 matches found
PT-2023-19184
Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description A critical issue affects the Web Management Interface component. The manipulation of the dpi argument leads to command injection, allowing remote attacks. The issue has been...
Wasmtime 安全漏洞
Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A security vulnerability exists in wasmtime versions 6.0.1 and earlier, 7.0.0, and 8.0.0, which stems from the fact that Wasmtime's implementation of managing per-instance state e.g.,...
DEBIAN-CVE-2023-1998
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PRSETSPECULATIONCTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to...
XWiki Platform 注入漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from XWiki France. The XWiki Platform suffers from an injection vulnerability that arises from the fact that in XWiki, each user can add a translation that applies only to the current user. Such translations...
Online Thesis Archiving System SQL注入漏洞
Online Thesis Archiving System by Carlo Montero Individual Developer provides an online platform to store student theses or capstone projects. A SQL injection vulnerability exists in Campcodes Online Thesis Archiving System version 1.0, which stems from a problem in the file...
Moderate: Red Hat Security Advisory: openvswitch3.1 security update
An update for openvswitch3.1 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
tweet-per-sec.com Cross Site Scripting vulnerability OBB-3245793
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
...
golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache...
Emotet Rises Again: Evades Macro Security via OneNote Attachments
The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542,...
SUSE CVE-2023-28531
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...
Fedora 36 : sudo (2023-cb5df36beb)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-cb5df36beb advisory. Security fix for CVE-2023-27320 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...
OESA-2023-1172 sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.13p2 has a double free in the per-command...
OESA-2023-1160 sudo security update
Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.13p2 has a double free in the per-command...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling such that ssh-add method adds smartcard keys to ssh-agent without the intended per-hop destination constraints. Remediation A fix was pushed into the master branch but not yet...
AZL-25662 CVE-2023-28531 affecting package openssh for versions less than 8.9p1-5
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...
CVE-2023-28531
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...
DEBIAN-CVE-2023-28531
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...
