PT-2023-34840 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to the handling of extension header length in rawv6 push pending frames. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-34819 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: A use-after-free race condition exists in the fastrpc maps. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.1 and is fixed in Lin...

CVE-2023-0240 Use after free in io_uring in the Linux Kernel

There is a logic error in iouring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the ioprepasyncwork function the assumption that the last iograbidentity call cannot return false is not true, and in this case the function will use...

CVE-2016-15022 mosbth cimage check_system.php cross site scripting

A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file checksystem.php. The manipulation of the argument $SERVER'SERVERSOFTWARE' leads to cross site scripting. The attack can be launched...

Integer Overflow Vulnerability in _addSplittable Function.

Lines of code Vulnerability details Impact splitsStorage.splitsStatesuserId.balancesassetId.splittable += amt; This vulnerability, if exploited, would allow an attacker to add a large amount of funds to a user's splittable balance, causing it to exceed the maximum value that the uint128 type can...

Incorrect calculation

Lines of code Vulnerability details Impact On line 119, the result of the conversion is always going to be zero. Therefore, functions that apply onlyDriver modifier will never be executed. Proof of Concept Please deploy the code below to test the modifier's broken implementation. //...

reentrancy in TimeswapV2Option.collect()

Lines of code Vulnerability details Impact collect function doesn't respect the check-effect-interaction pattern, where in the case if a param.data is provided it makes an external call to the caller, right after that, it updates option short amount state. in the case if the caller calls back int...

PT-2023-10322 · Devise · Devise

Name of the Vulnerable Software and Affected Versions: Devise versions prior to 3.5.4 Description: The issue concerns the mishandling of Remember Me cookies for sessions, potentially allowing an adversary to gain unauthorized persistent application access. Specifically, the Devise gem generates t...

PT-2023-1799 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

Landis+Gyr E850

1. EXECUTIVE SUMMARY CVSS v3 3.9 ATTENTION: Low attack complexity Vendor: Landis+Gyr Equipment: E850 ZMQ200 Vulnerability: Reliance on Cookies without Validation and Integrity 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service condition for the end...

PT-2023-13432 · Isc · Bind 9

Name of the Vulnerable Software and Affected Versions: BIND 9 versions 9.11.4-S1 through 9.11.37-S1 BIND 9 versions 9.16.8-S1 through 9.16.36-S1 Description: The issue arises when processing repeated responses to the same query, where both responses contain ECS pseudo-options, but the first...

PT-2023-12841 · Unknown · Vagrant.Js

Name of the Vulnerable Software and Affected Versions: vagrant.js versions all Description: The issue arises from improper input sanitization in the boxAdd function, leading to Command Injection. This allows for potential execution of arbitrary commands. Recommendations: For all versions, conside...

PT-2023-19604 · Jenkins · Jenkins Openid Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: The issue arises because the plugin does not invalidate the previous session on login. Recommendations: For Jenkins OpenID Plugin versions 2.4 and earlier, update to a version later...

PT-2023-19587 · Jenkins · Jenkins Bitbucket Oauth Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier Description: The issue arises because the Jenkins Bitbucket OAuth Plugin does not invalidate the previous session on login, which can lead to potential security risks. Recommendations:...

PT-2023-19611 · Jenkins · Jenkins View-Cloner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins view-cloner Plugin versions 1.1 and earlier Description: The issue allows passwords to be stored unencrypted in job config.xml files on the Jenkins controller. Users with Extended Read permission or access to the Jenkins controller fi...

PT-2023-19386 · Signal · Signal Desktop +1

Name of the Vulnerable Software and Affected Versions: Signal Desktop versions prior to 6.2.0 Description: The issue allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some case...

PT-2023-15474 · WordPress · Geodirectory

Name of the Vulnerable Software and Affected Versions: GeoDirectory WordPress plugin versions prior to 2.2.22 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which can lead to Stored Cross-Site Scripting attacks. Users with a role as low as...

_locateCurrentAmount function, there is an assembly operation that is dividing by duration without a zero check

Lines of code Vulnerability details Impact In the locateCurrentAmount function, there is an assembly operation that is dividing by duration without a zero check, which could cause a division by zero error. Proof of Concept // Check for division by zero requireduration != 0, "Division by zero...

PT-2023-15423 · WordPress · Oneclick Chat To Order

Name of the Vulnerable Software and Affected Versions: OneClick Chat to Order WordPress plugin versions prior to 1.0.4.2 Description: The issue arises from the plugin not validating and escaping some of its shortcode attributes before outputting them back in the page. This could allow users with ...

SWC-109 Uninitialized Storage Pointer

Lines of code Vulnerability details Impact Uninitialized storage variables can point to unexpected storage locations. Proof of Concept // Exploitable Vulnerability MemoryPointer callData; Tools Used github Recommended Mitigation Steps // Initialize variable "callData" or set the storage attribute...