CVE-2023-40178

Node-SAML CVE-2023-40178 is a functional issue in validatePostRequestAsync that allows LogoutRequest XML to be reused beyond NotOnOrAfter due to missing current-timestamp checks. Root cause: absence of timestamp validity checks in the LogoutRequest validation flow (e.g., validatePostRequestAsync/...

EC-CUBE 跨站脚本漏洞

EC-CUBE is an open source e-commerce system from the Japanese company EC-CUBE. A security vulnerability exists in EC-CUBE versions 2.11.0 through 2.17.2-p1, which stems from the presence of a cross-site scripting vulnerability that could allow execution of arbitrary scripts on the web browser of...

PT-2023-21568 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.5.6 Description: The issue concerns the AI ChatBot WordPress plugin, which does not properly sanitise and escape numerous settings. This could allow high-privilege users, such as administrators,...

Unfair handling of rewards for users with a high amount of rewards

Lines of code Vulnerability details Users can claim their rewards in RewardDistributor.claimRewardToken. The reward handling part is done in grantRewardToken: 416: function grantRewardTokenaddress user, uint256 amount internal returns uint256 417: uint256 rewardTokenRemaining =...

Mitigation of M-04: Mitigation error

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-04: Mitigation error Link to Issue: code-423n4/2023-03-asymmetry-findings932 Comments Even though the original issue is mitigated, as the exchange through Uniswap V3 has been completely removed in favor of using...

freezeOperator will not be able to freeze an operator

Lines of code Vulnerability details Impact freezeOperator will not be able to freeze an operator address in blockchain reorg situation Proof of Concept canSlash function is relying on block.number as it should be lower than contractCanSlashOperatorUntilBlock. that will work fine until a reorg on...

PT-2023-22165 · Mediawiki +1 · Growthexperiments +1

Name of the Vulnerable Software and Affected Versions: GrowthExperiments extension for MediaWiki versions through 1.39.3 Description: An issue in the GrowthExperiments extension for MediaWiki allows the UserImpactHandler to inadvertently return the timezone preference for arbitrary users. This ca...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...

SUSE CVE-2008-5303

Race condition in the rmtree function in File::Path 1.08 lib/File/Path.pm in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. ...

SUSE CVE-2011-3616

The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf...

SUSE CVE-2013-1500

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previou...

SUSE CVE-2014-1875

The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file...

SUSE CVE-2014-4021

Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors...

SUSE CVE-2015-0413

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability...

SUSE CVE-2015-1865

fts.c in coreutils 8.4 allows local users to delete arbitrary files...

SUSE CVE-2016-6153

osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impact by leveraging use of the current working directory for...

SUSE CVE-2017-8072

The cp2112gpiodirectioninput function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors...

SUSE CVE-2019-4473

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984...

SUSE CVE-2022-4842

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attrpunchhole was found. A local user could use this flaw to crash the system...

inital share manipulation attack possible in Vault

Lines of code Vulnerability details Description This is the classic share inflation attack described here: The popcorn Vault is an abstraction on top of other vaults which acts like adapters to wrap other yield bearing protocols. Hence the asset in Vault are the shares in this adapter. An early...