generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

GHSA-4GPM-R23H-GPRW generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

Design/Logic Flaw

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

CVE-2015-20110

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

CVE-2015-20110

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...

Relying on string comparisons to determine which parameter to update in the file() function is brittle and could lead to unintended consequences.

Lines of code Vulnerability details Impact This can allow unintentionally changing sensitive state variables Proof of Concept The vulnerability arises because: file relies on a simple string comparison of the what parameter to determine which state variable to update. A developer could accidental...

ASUS RT-AX88U web.c Buffer Overflow Vulnerability

The ASUS RT-AX88U is a wireless router from Asus China. The ASUS RT-AX88U suffers from a buffer overflow vulnerability that stems from a failure to check the buffer input size, which can be exploited by a remote attacker to send a specially crafted request to a device that contains a specific use...

CVE-2023-34358

ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition...

SolarWinds Orion Platform UpdateActionsProperties Incorrect Comparison Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the UpdateActionsProperties method. The issue results from an incorrect string...

SUSE CVE-2010-3072

The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted request...

Improper String Comparison

erik-dubbelboer/php-redis-admin is vulnerable to improper string comparison. Improper use of operator in string comparison in authHttpDigest function of the file includes/login.inc.php allows an attacker to cause a magic hash attack via the response parameter...

CVE-2021-4259

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 i...

CVE-2021-4259

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 i...

Sql injection

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 i...

PT-2022-11628 · Unknown · Phpredisadmin

Name of the Vulnerable Software and Affected Versions: phpRedisAdmin versions up to 1.17.3 phpRedisAdmin versions up to 1.16.1 can be simplified to the above line as 1.17.3 includes all versions up to 1.16.1, so the final output is: phpRedisAdmin versions up to 1.17.3 Description: A vulnerability...

CVE-2021-4259 phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 i...

phpRedisAdmin 安全漏洞

phpRedisAdmin is a web administration page for managing Redis for individual developers. A security vulnerability exists in phpRedisAdmin 1.17.3 and earlier, which stems from an issue with the authHttpDigest function in the file includes/login.inc.php, where manipulation of the parameter response...

USN-5763-1: NumPy vulnerabilities

It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-33430 It was discovered that NumPy di...

USN-5763-1 numpy vulnerabilities

It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-33430 It was discovered that NumPy di...

Ubuntu 20.04 LTS / 22.04 LTS : NumPy vulnerabilities (USN-5763-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5763-1 advisory. It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running...