GitLab Denial of Service Vulnerability (CNVD-2021-25684)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab has a security vulnerability in versions after...

UBUNTU-CVE-2021-22177

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command...

GitLab 资源管理错误漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab has a security vulnerability in versions after...

CVE-2020-28873

Fluxbb 1.5.11 is affected by a denial of service DoS vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server...

XML Entity Injection Vulnerability in Alkacon OpenCms

Alkacon OpenCms is a set of open source content management system CMS developed using the Java language . Alkacon OpenCms suffers from an XML entity injection vulnerability that can be exploited by an attacker to access server resources...

Rakkess - Kubectl Plugin To Show An Access Matrix For K8S Server Resources

Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview? This is...

The vulnerability of the File Server Resource Manager, a component of the Windows operating system, allows attackers to increase their privileges.

The vulnerability of the File Server Resource Manager in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially created application...

KLA11929 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A memory corruption...

Amazon Linux 2 : bind (ALAS-2020-1441)

The version of bind installed on the remote host is prior to 9.11.4-9.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1441 advisory. managed-keys is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which...

Xiamen Ejin Online Financial Information Service Co., Ltd.'s Good Lending Loan King Has Logic Flaw Vulnerabilities

Good Borrower Loan King app is a mobile lending tool developed by Ejin Online. Xiamen Ejin Online Financial Information Service Co., Ltd.'s Good Lending Money Loan King has a logic flaw vulnerability that can be exploited by an attacker to The attacker can take advantage of the loophole to regist...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

ALPINE-CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write many of the byt...

Servicing stack update for Windows 10, Version 1903: May 14, 2019

None None...

CVE-2018-19963

CVE-2018-19963 affects Xen 4.11 and is caused by mishandling of x86 IOREQ server resource accounting for external emulators. It can enable a local HVM guest OS user to crash the host OS or potentially gain host privileges. The connected documents reference Xen advisory XSA-276; no explicit patch/...

MicroTalk App Has SMS Bombing Vulnerability

MicroTalk App is a calling software. MicroTalk APP has SMS bombing vulnerability. The attacker sends unlimited CAPTCHA to the cell phone by catching packets through the forget password function, consumes server resources, and carries out SMS bombing...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Short summary Hi, I noticed that the following report has been fixed and closed, however the bug has reappeared in different parameters: https://hackerone.com/reports/204208 Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumptio...

Logic design flaws in the Android version of the E-Care App

E Nursing APP is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shanghai Moyi Information Technology Development Co. There is a logical design vulnerability in the Android version of the E-Care...

Logic Design Vulnerability in Tlink IoT Cloud Service Platform Android App

TLINK Internet of Things is an open platform for Internet of Things products of Shenzhen Analog Technology Co. A logical design vulnerability exists in the Android App password recovery function of Tlink IoT cloud service platform. It allows the attacker to send unlimited SMS to the modified cell...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

WordPress GD bbPress Attachments 2.1 Cross Site Scripting / Local File Inclusion Vulnerabilities

WordPress GD bbPress Attachments plugin version 2.1 suffers from a cross site scripting and Local File Inclusion Vulnerabilities Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report:...