5825 matches found
kernel: Linux kernel: Denial of Service via malicious MTU negotiation in TIPC
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC protocol. A malicious peer can exploit this by sending a specially crafted Activate message with a very small Maximum Transmission Unit MTU value during link MTU negotiation. This can lead to an integer overflow,...
CLSA-2023-1698945053 libgcrypt: Fix of 4 CVEs
CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks - CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks - CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys - CVE-2021-40528: Add exponent...
Temporary DOS attack on users minting and redeeming big amount using EthenaMinting.sol
Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol with a large amount can be vulnerable to DOS attack. Proof of Concept There is a limit on the max amount to redeem and mint in a block. This can be crucial to the users that are minting or redeeming...
How helpful are estimates about how much cyber attacks cost?
Coming from the newspaper and media industry, Im no stranger to wanting to write catchy headlines. Im certainly at fault for throwing together a story about so-and-sos house sold for X million dollars. But recently Ive been wondering if those "big numbers" for cybersecurity are helpful at all, ev...
Small CRM Request a Quote Field Cross-Site Scripting Vulnerability
Small CRM is a customer relationship management system. Small CRM suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of data provided in the Request a Quote field, which can be exploited by an attacker to store and execute malicious...
In-Depth Analysis of Phobos Ransomware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Phobos ransomware, active since 2018, primarily targets small to medium-sized businesses with lower ransom demands. It uses compromised RDP connections, is distributed via a Ransomware as a Service model...
CVE-2023-45394
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
The CVE-2023-45394 issue affects Small CRM v3.0, described as a Stored Cross-Site Scripting (XSS) vulnerability in the Company field of the "Request a Quote" section. The root cause is unsafely handling input in that field, enabling an attacker to store and execute malicious JavaScript in the Adm...
CVE-2023-45394: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
PT-2023-29546
Name of the Vulnerable Software and Affected Versions Small CRM version 3.0 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability in the Company field of the "Request a Quote" section. This allows an attacker to store and execute malicious javascript code in the Admi...
CVE-2023-5587
The CVE-2023-5587 entry describes a SQL injection in SourceCodester Free Hospital Management System for Small Practices 1.0, specifically in the /vm/admin/doctors.php file of the Parameter Handler. The vulnerability arises from unsafeguarded manipulation of the search parameter, allowing remote a...
CVE-2023-5587: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /vm/admin/doctors.php of the component Parameter Handler. The manipulation of the argument search leads ...
Rounding error leading to no reward being sent
Lines of code Vulnerability details Impact Rounding errors could occur if the provided amount is too small, Proof of Concept rewardsToSend += inRangeLiquidityOfPosition concRewardPerWeekpoolIdxweek / overallInRangeLiquidity; uint256 rewardsForWeek = timeWeightedWeeklyPositionAmbLiquidity poolIdx...
CVE-2023-44075
Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter...
