1148 matches found
SUSE CVE-2019-14857
A flaw was found in modauthopenidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in modauthmellon...
SUSE CVE-2020-23171
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file...
SUSE CVE-2020-28724
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL...
SUSE CVE-2022-4244
A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...
Mitigation Confirmed for Mitigation of H-06 Issue mitigated
C4 issue H-06: MinipoolManager: node operator can avoid being slashed Comments In the original implementation, there were a few scenarios where malicious node operators can avoid being slashed. Mitigation PR 41 This PR includes mitigation for various issues H-03, H-06, M-13. Just focusing on the...
The vulnerability of the web application function of Moxa SDS-3008 microprogrammable Ethernet switches allows a intruder to gain unauthorized access to protected information.
The vulnerability of the web application function of Moxa SDS-3008 Ethernet switch software lies in the insufficient protection of service data when processing URL addresses containing the “/” or “\” character. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...
Upgraded Q -> 3 from #867 [1675460716325]
Judge has assessed an item in Issue 867 as 3 risk. The relevant finding follows: L-02, MinipoolManager, lines 670 - 684: The slash function slashes a node operator for the amount of whole duration. Since the cycles are in 14 days and the slashing is checked in the recordStakingEnd, if an operator...
MinipoolManager: node operator can avoid being slashed
Lines of code Vulnerability details Impact When staking is done, a Rialto multisig calls MinipoolManager.recordStakingEnd . If the avaxTotalRewardAmt has the value zero, the MinipoolManager will slash the node operator's GGP. The issue is that the amount to slash can be greater than the GGP balan...
Upgraded Q -> 3 from #508 [1675443043181]
Judge has assessed an item in Issue 508 as 3 risk. The relevant finding follows: L-05 Duration does not have upper bound The duration input parameter does not have upper bound. If the duration is mistakenly set too high, node operator will be slashed significant amount of GGP. The...
Upgraded Q -> M from #694 [1675343502331]
Judge has assessed an item in Issue 694 as M risk. The relevant finding follows: there is no check that duration of the Minipool is bigger than 14 days and a malicious node runner can set duration as 0 day and if he fails the calculated slash amount would be 0. --- The text was updated...
Upgraded Q -> H from #694 [1675343512989]
Judge has assessed an item in Issue 694 as H risk. The relevant finding follows: there is no check that duration of the Minipool is less than 365 days and if user by mistake set very high value for duration and fails to run node properly user would lose very large number of his GGP collaterals...
CVE-2023-22341
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...
golang: net/url: JoinPath does not strip relative path components in all circumstances
A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack...
CVE-2021-4280
A vulnerability was found in stylerpraatscripts. It has been classified as problematic. Affected is an unknown function of the file filesegmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch ...
CVE-2021-4280
A vulnerability was found in stylerpraatscripts. It has been classified as problematic. Affected is an unknown function of the file filesegmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch ...
Input validation
A vulnerability was found in stylerpraatscripts. It has been classified as problematic. Affected is an unknown function of the file filesegmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch ...
CVE-2021-4280 styler_praat_scripts Slash file_segmenter.praat denial of service
A vulnerability was found in stylerpraatscripts. It has been classified as problematic. Affected is an unknown function of the file filesegmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch ...
Praat Script Collection 安全漏洞
Praat Script Collection is a collection of Praat scripts by Will Styler, an individual developer. A security vulnerability exists in Praat Script Collection that stems from an issue with an unknown function in the filesegmenter.praat file in the component Slash Handler, which can lead to a denial...
Path Traversal
lite-dev-server is vulnerable to path traversal. The vulnerability exists in server.js because it aims to access files and directories that are stored outside the intended folder. By manipulating files with dot-dot-slash ../ sequences and its variations it may be possible to access arbitrary file...