16726 matches found
CVE-2023-49101
WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates...
PT-2024-20806 · L8W8Jwt · L8W8Jwt
Name of the Vulnerable Software and Affected Versions: l8w8jwt version 2.2.1 Description: The issue arises from the use of memcmp to verify authentication, which is not constant time. This makes it easier to bypass authentication via a timing side channel. Recommendations: For l8w8jwt version...
PT-2024-2322
Name of the Vulnerable Software and Affected Versions ip package versions prior to 1.1.9 Description The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic function. This can lead to security issues such as Server-Side Request Forgery SSR...
PT-2024-13675
Name of the Vulnerable Software and Affected Versions Axigen versions 10.3.x through 10.3.3.60 Axigen versions 10.4.x through 10.4.23 Axigen versions 10.5.x through 10.5.9 Description The issue allows XSS attacks against admins due to mishandling of viewing the usage of SSL certificates...
CKEditor cross-site scripting vulnerability in AJAX sample
Affected packages The vulnerability has been discovered in the AJAX sample available at the samples/old/ajax.html file location. All integrators that use that sample in the production code can be affected. Impact A potential vulnerability has been discovered in one of CKEditor's 4 samples that ar...
PT-2024-14946 · Gitlab · Gitlab Ce/Ee
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.11 through 16.6.6 GitLab CE/EE versions 16.7 through 16.7.4 GitLab CE/EE versions 16.8 through 16.8.1 Description: A denial of service issue was identified in GitLab CE/EE, which allows an attacker to increase the...
No License consumption after changing the License type
After changing the License type to concurrent the Licenses were not consumed License usage showed as 0 Used...
python-multipart Resource Management Error Vulnerability
python-multipart is a streaming multipart parser for Python by the individual developer Marcelo Trylesinski. A resource management error vulnerability exists in versions prior to python-multipart 0.0.7, which stems from the package python-multipart consuming CPU resources and stopping indefinitel...
CVE-2024-22667
Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions...
Browser-based Application's Page Fails to Load With: ERR_SSL_KEY_USAGE_INCOMPATIBLE
Article Applicability The error discussed in this article is caused by a misconfiguration of the website's certificate. Specifically, the ERRSSLKEYUSAGEINCOMPATIBLE error occurs when the certificate used by a website has a KeyUsage value defined, but it does not include "Digital Signature" and...
Etcd embed auto compaction retention negative value causing a compaction loop or a crash
Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...
PT-2024-1623 · Qnap · Qnap Qts +2
Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.5.2645 build 20240116 QNAP QuTS hero versions prior to h5.1.5.2647 build 20240118 QNAP QuTScloud versions prior to c5.1.5.2651 Description: An uncontrolled resource consumption issue has been reported, potential...
Optimizing Data Lakes: Streamlining Storage with Effective Object Management
Data lakes are a popular solution for data storage, and for good reason. Data lakes are flexible and cost effective, as they allow multiple query engines and many object formats without the need to manage resources like disks, CPUs, and memory. In a data lake, data is simply stored in an object...
DEBIAN-CVE-2023-6246
A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name the basename of...
Advisory ROSA-SA-2024-2332
Software: glibc 2.28 OS: ROSA Virtualization 2.1 packageevrstring: glibc-2.28-225.rv3.src.rpm CVE-ID: CVE-2023-4527 BDU-ID: 2023-06332 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the getaddrinfo function of the glibc system library is related to reading data outside of buffer boundaries in...
Bruce Schneier predicts a future of AI-powered mass spying: Lock and Code S05E03
This week on the Lock and Code podcast… If the internet helped create the era of mass surveillance, then artificial intelligence will bring about an era of mass spying. That’s the latest prediction from noted cryptographer and computer security professional Bruce Schneier, who, in December, share...
Linux kernel btrfs_get_root_ref Heap Buffer Overflow DoS
The vulnerability of the btrfsgetrootref function fs/btrfs/disk-io.c in the Linux kernel is related to the insufficient use of the assert function. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2023-52340
A flaw in the routing table size was found in the ICMPv6 handling of "Packet Too Big". The size of the routing table is regulated by periodic garbage collection. However, with "Packet Too Big Messages" it is possible to exceed the routing table size and garbage collector threshold. A user located...
