4414 matches found
CVE-2023-20575
A flaw was found in hw, where a potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM, potentially resulting in a leak of sensitive information. Mitigatio...
ProfileGrid < 5.5.2 - Subscriber+ Arbitrary Option Update
Description The plugin does not implement an adequate capability check on the 'profilemagicchecksmtpconnection' function, making it possible for authenticated users with subscriber-level permissions or above to arbitrarily update the site options, leading to potential privilege escalation...
A proposer can initiate several proposals at once through delegations
Lines of code Vulnerability details Impact Within the NounsDAOV3Proposals' propose function, a proposer is only permitted to have one active proposal at a time. Despite this, a proposer has the capability to delegate to various accounts, enabling these accounts to propose on their behalf. Proof o...
RHEL 8 : firefox (RHSA-2023:4075)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4075 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
Well.sol#removeLiquidityImbalanced - Handling Excess Reserves in removeLiquidityImbalanced Function to Prevent Unnecessary Reverts
Lines of code Vulnerability details Impact The removeLiquidityImbalanced function in the Well.sol contract is vulnerable to a potential underflow. This could disrupt the contract's functionality and prevent users from removing liquidity in an imbalanced manner. Furthermore, the function does not...
Mail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The plugin does not adequately sanitize input or escape output for email subjects, resulting in potential for stored cross-site scripting...
CVE-2021-33798
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute via a crafted file...
CVE-2021-33798
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute via a crafted file...
PT-2023-25405 · Unknown · Piigab M-Bus
Name of the Vulnerable Software and Affected Versions: PiiGAB M-Bus affected versions not specified Description: The issue concerns hard-coded credentials used for authentication in PiiGAB M-Bus. No information is provided about the estimated number of potentially affected devices or real-world...
Memory corruption
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in PyFindObjects function...
PYSEC-2023-102
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in PyFindObjects function...
Classified Listing < 2.4.6 - Cross-Site Request Forgery
The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability...
Server side request forgery (ssrf)
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery SSRF using the Web Service Eventing model...
CVE-2023-35931 Shescape potential environment variable exposure on Windows with CMD
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1...
Information disclosure
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...
Azure AD アプリケーションにおける特権昇格の潜在的なリスクについて
本ブログは、Potential Risk of Privilege Escalation in Azure AD Applications の抄訳版です。最新の情報は原文を参照してください。 概要...
US dangles $10 million reward for information about Cl0p ransomware gang
The US Department of States national security rewards program, Rewards for Justice RFJ, is offering a reward of up to $10 million for information linking the Cl0p ransomware gang, or any other malicious cyber actors targeting US critical infrastructure, to a foreign government. Advisory from...
CVE-2023-25733
The return value from gfx::SourceSurfaceSkia::Map wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox 110...
Upgraded Q -> 2 from #16 [1686928129422]
Judge has assessed an item in Issue 16 as 2 risk. The relevant finding follows: L-3 onlyOwner single point of failure Impact The onlyOwner role has a single point of failure and onlyOwner can use critical a few functions. Even if protocol admins/developers are not malicious there is still a chanc...
