PT-2023-19952 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: Discourse is an open source discussion platform. A malicious user can cause a regular expression denial of service using a carefully crafted git URL...

Exploit for OS Command Injection in Exiftool_Project Exiftool

Introduction CVE-2022-23935 exploit PoC exiftool...

Exploit for OS Command Injection in Exiftool_Project Exiftool

Introduction CVE-2022-23935 exploit PoC exiftool...

UBUNTU-CVE-2023-24808

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service DOS vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28...

MGASA-2023-0030 Updated python-future packages fix security vulnerability

Excessive CPU usage via a crafted Set-Cookie header CVE-2022-40899...

Updated python-future packages fix security vulnerability

Excessive CPU usage via a crafted Set-Cookie header CVE-2022-40899...

The State of the Cloud 2023

Wiz's State of the Cloud 2023 report provides analysis of trends in cloud usage such as multi-cloud, use of managed services and more. In addition, the report highlights notable cloud risks based on insights from 30% of Fortune 100 enterprise cloud environments...

Malicious Package

Overview methantiafk is a malicious package. It distributes Discord malware hosted on GitHub, that can steal important host information and credentials. Remediation Avoid using all malicious instances of the methantiafk package. References - Injected Code Credit: Snyk Research Team...

Upgraded Q -> 2 from #615 [1675724239375]

Judge has assessed an item in Issue 615 as 2 risk. The relevant finding follows: Unbounded gas usage in claim function of Quest contract The claim function has an unbounded gas usage that traverses different arrays many times. The call to RabbitHoleReceipt.getOwnedTokenIdsOfQuest iterates all...

FreeBSD : Django -- multiple vulnerabilities (c49a880d-a5bb-11ed-aab5-080027de9982)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c49a880d-a5bb-11ed-aab5-080027de9982 advisory. - In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of...

CVE-2023-24806

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...

Denial Of Service (DoS)

Django is vulnerable to Denial Of Service DoS. The vulnerability exists because transreal.py caches the Accept-Language headers, allowing an attacker to cause an application crash via excessive memory usage if the value of the Accept-Language headers are very large...

Exploit for Deserialization of Untrusted Data in Ibm Aspera_Faspex

CVE-2022-47986 Aspera Faspex Pr...

Array Networks AG 缓冲区错误漏洞

Array Networks AG/vxAG is an Array SSL-VPN gateway product from Array Networks, Inc. A security vulnerability exists in Array Networks AG. A remote attacker with administrator privileges could use the gdb utility to overwrite the back-end function call stack to trigger a denial of service attack...

PT-2023-15562 · Nomachine · Nomachine

Name of the Vulnerable Software and Affected Versions: NoMachine versions prior to 8.2.3 Description: An issue in NoMachine allows attackers to execute arbitrary commands via a crafted .nxs file. Recommendations: For versions prior to 8.2.3, update to version 8.2.3 or later to resolve the issue. ...

GitLab 12.4.x < 15.6.7, 15.7.x < 15.7.6, 15.8.x < 15.8.1 DoS Vulnerability

GitLab is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; if...

CVE-2023-23969

A flaw was found in python-django. The parsed values of the Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial of service vector via excessive memory usage if large header values are sent...

GHSA-Q2JF-H9JM-M7P4 Django contains Uncontrolled Resource Consumption via cached header

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very larg...

Django contains Uncontrolled Resource Consumption via cached header

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very larg...

PYSEC-2023-12

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very larg...