github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset

Impact Rapidly creating and cancelling streams HEADERS frame immediately followed by RSTSTREAM without bound cause denial of service. See https://vulners.com/cve/CVE-2023-44487 for details. Patches nghttp2 v1.57.0 mitigates this vulnerability by default. Workarounds If upgrading to nghttp2 v1.57....

Design/Logic Flaw

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation which...

CVE-2023-45129 matrix-synapse vulnerable to denial of service due to malicious server ACL events

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation which...

PT-2023-32133 · Byzoro · Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230928 Description: A critical issue affects some unknown functionality of the file /log/download.php, where the manipulation of the file argument...

PT-2023-6138 · Microsoft · Windows Directx +2

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Windows DirectX affected versions not specified Description: The issue is related to a synchronization error, specifically a race condition, when using a shared resource in the Window...

PT-2023-29530 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.5 MediaWiki versions 1.40.x prior to 1.40.1 Description: An issue was discovered in the Vector Skin component for MediaWiki. The vector-toc-toggle-button-label is not escaped, but should be, because the line...

PT-2023-6394 · F5 · Big-Ip Local Traffic Manager +5

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions prior to the fixed version Description: The issue is related to insecure privilege management in BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Application Security Manager, BIG-IP Domain Name System...

PT-2023-32127 · Byzoro · Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230928 Description: A critical issue affects some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the file upload...

Samba AD DC Busy RPC multiple listener DoS

Description Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those services focused on the AD DC are started in the main "samba" process, while services focused on the fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launche...

PT-2023-6006 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.2.0 through 7.2.3 FortiManager version 7.4.0 Description: The issue is related to an improper neutralization of special elements used in an os command, which may allow an attacker to execute unauthorized code or comman...

PT-2023-5996 · Fortinet · Fortianalyzer

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer versions 7.4.0 and below 7.2.3 Description: The issue is related to insufficient verification of data authenticity, allowing a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via knowledge ...

PT-2023-32138 · Unknown · Shenzhen Reachfar

Name of the Vulnerable Software and Affected Versions: Shenzhen Reachfar version v28 Description: The issue allows a remote attacker to retrieve all the week's logs stored in the 'log2' directory, potentially exposing sensitive information such as remembered wifi networks, sent messages, SOS devi...

PT-2023-6169

Name of the Vulnerable Software and Affected Versions Sangfor Next-Gen Application Firewall version NGAF8.0.17 Description The issue is related to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP PO...

Design/Logic Flaw

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

Security Bulletin: Vulnerability in Python affects IBM Process Mining . CVE-2022-48560

Summary There is a vulnerability in Python that could allow a remote attacker to execute a denial of service. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-48560 DESCRIPTION: Python i...

Node.js: Regular Expression Denial of Service in Headers fetch API

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normali...

PT-2023-7093 · Asus · Asus Rt-Ax57

Name of the Vulnerable Software and Affected Versions: ASUS RT-AX57 version 3.0.0.4 386 52041 Description: The issue exists due to insufficient input validation in the sub 4CCE4 function of the ASUS RT-AX57 Wi-Fi router's firmware. This allows a remote attacker to execute arbitrary code by sendin...