2016.11.30 14:08 thisman CustomKeyboards - For customs only!
2019.05.16 20:19 overloadrages customfeeds
2020.03.21 06:04 Cxruption ACNHCustomDesigns
2023.05.29 06:01 subreddit_stats Subreddit Stats: sffpc top posts from 2019-04-24 to 2023-05-15 05:20 PDT
Submissions | Comments | |
---|---|---|
Total | 1000 | 109593 |
Rate (per day) | 0.67 | 73.32 |
Unique Redditors | 782 | 25569 |
Combined Score | 1446245 | 736930 |
Generated with BBoe's Subreddit Stats
2023.05.19 18:00 LabB0T Weekly r/homelabsales Summary - 2023-05-19
CANON
EUBE
OtherASIA-SG
UKUK
US-C-ANY-
US-E-ANY-
US-W-ANY-
2023.05.17 23:21 blumunke Couple new additions came in today!!!
![]() | Gonna break them in before i put them in the display. From left to right. Hatakeyama FB. Rev1x. A2000 pudge. NP pro preferred custom(purchased second hand). Have a ton more coming in. submitted by blumunke to BaseballGloves [link] [comments] |
2023.05.16 06:59 amynias Loving the Lenovo P360 Ultra Mini Workstation
![]() | I wanted to share my SFF PC setup with you all. I recently acquired a Lenovo P360 Ultra mini workstation (3.9 Liter case) for 53% off retail price ($4700, paid $2200) new from Lenovo and upgraded the RAM and storage at MicroCenter. Intel i9-12900 16 core Alder Lake CPU, 128GB DDR5-4800MHz Samsung RAM, an NVIDIA PNY RTX A2000 12 GB SFF desktop graphics card with 4 mini DP outputs, 2 separate identical 1 TB NVMe SSD drives, one with Windows 11 and one with Manjaro Gnome Arch Linux (Both desktops pictured), 2 GbE ports, 5 USB 3.2 A ports, 2 Thunderbolt USB C 4 ports, Intel AX211 WiFi with Bluetooth 5.2 dual-band antenna pictured. submitted by amynias to sffpc [link] [comments] Other featured parts of my setup: the legendary $3,000 (bought for $1700 new) LG LG 27EP950-B 27” Ultrafine UHD (3840 x 2160) OLED Pro Enterprise Display with USB-C, 2 DP, 1 HDMI, and 3 USB 3.0 port hub; JDS Labs Atom+ DAC/Amp stack, Bose Companion II speakers, the $600 Sennheiser HD660S2 audiophile headphones, the Logitech K860 Ergo with MX Vertical wireless mouse, the Samsung Duo wireless charging pad (S23 Ultra not pictured on left of pad) with Galaxy Buds Pro 2 pictured in charging case, Google Nest Pro WiFi 6E extender, Logitech C930e business webcam, LARQ filter bottle, cute little gold-painted ceramic owl, vinyl birch wood and anodized steel desk. I'm quite proud of my mini PC desktop setup. This thing punches well above its weight. Let me know what you think! |
2023.05.12 16:21 WP-Genius How To Build A PC Under Rs 80000 for Gaming and Editing 2023
2023.05.09 21:58 OptiPlonker Heaven Benchmark
2023.05.09 21:46 dnards22 [USA-MA][H] Watercooled r5 5600 Pc [W] Local Cash
2023.05.06 13:51 Independent-Steak-73 Rtx A2000 temperatures
2023.04.14 11:23 raable Now available again: custom RTX A2000 heatsink
![]() | submitted by raable to sffpc [link] [comments] |
2023.04.07 08:00 Hobbes-Is-Real Debate Challenge Issued: Liquid Cooling or Air Cooling for Home Plex Server & NAS Running 24/7
2023.03.30 13:47 xixoa NR200 triple rad, aka the submarine
![]() | Hi submitted by xixoa to watercooling [link] [comments] So after almost two years I consider my build as done! I have been upgrading parts and components every once in a while and when I had time. I named my build the submarine, cause everything is as tight as one. Components: 5800X + barrow cpu + pump + reservoir Aorus X570i Pro Wifi AMD 6900XT + aquacomputer block 32Gb kingston hyperX fury 3200MHz CL16 750W corsair SFX platinum 2 Kingstons M.2 A2000 1TB NR200P aquacomputer quadro alphacool 92 and 240 slim rad byski 240 rad noctua 120 slims and 92 fans mix of bykski, corsair, alphacool fittings EK cryofuel amber clear bykski 10/16 soft tubing Byski flow meter 2x alphacool temp sensors I think now I am not going to upgrade, change anything for a loong time. I was testing last two days and WoT (1440p ultra, 75fps cap and fans at 1000rpm) water never exceeds 31ºC with a room at around 20-21ºC. I prefer silence to anything. I would like to give kudos to u/Wazooowwski to show me the way to fit a third slim rad on top without top hat (mod that I was considering for really long time). I am running 5800X with PBO-30 (I think I won silicon lottery because I usually see 4850-4875Mhz) and 6900XT with 95% voltage, stable. I have three temp sensors, two alphacools and one byski and normally I don't see much difference between each other after the loop has stabilized. They all are at different parts of the loop) Things I would do differently. no white: it is cool but it was really difficult to maintain the "all white" build. If you find stock you pay an extra premium that is not realistic (fittings, rads, etc) Different GPU. No issues with mine which I bought second hand with really good price. But I would get something a bit less powerful and small. For the games I play I don't need such power. Last, maybe, maybe not, buy again the cpu combo. Nothing wrong with it, but it is a pain in the ass to fill the loop, the position of the inlet, outlet, fill port are super inconvenient in a tight build. Pump is a bit noisy. But price was, when I bought it, (Dec 20) super good at around 90e RGB. I coulnd't find a single program to coordinate all rgb so I stop trying. Probably I would get everything non RGB for next build. just for the lols how far away I came. This is my first loop and started life in same case but with a ryzen 3600 and a 1660super itx. Quite a performance bump i would say. Here I posted in buildsgg back then (https://builds.gg/builds/itx-first-custom-water-loop-28431) https://preview.redd.it/0fv83fpd7vqa1.jpg?width=4000&format=pjpg&auto=webp&s=1105e7feca5fb4f24a7913cd0a00a28822ef4408 https://preview.redd.it/r12m533c7vqa1.jpg?width=4000&format=pjpg&auto=webp&s=3b4c453eb1dad23ff143ba8da930be5038ece229 https://preview.redd.it/0t534or47vqa1.jpg?width=4000&format=pjpg&auto=webp&s=cac4cee59c36496ae2b679a4a516cb6c5de1c86e |
2023.03.30 02:36 stupidsimplesoftball Stupid Simple Softball YouTube Reviews Up Soon!
![]() | Good Afternoon Everyone!! submitted by stupidsimplesoftball to BaseballGloves [link] [comments] After taking the time to acquire & break in a few of these bad boys I have finally started to film & edit some videos for the channel! I got a lot of work to do before I start getting everything up on the channel but I promise it will come! We will be providing reviews of gloves, glove care products, bats & grips, batting gloves and more! Let me know if there is one in particular that you want to see first! Insta: @stupidsimplesoftball YouTube: https://youtube.com/@Stupidsimplesoftball Top Row - Nokona P8 Bloodline Edge 12.75” Top Middle Row (Left to Right) - 44 Pro Custom 12.25” - Miken Player Series 15” - Miken Player Series 14” Bottom Row Mid (Left to Right) - Mizuno Pro 12.75” - Wilson A2K Mookie Betts 12.5” - Wilson A2000 Custom 14” - Rawlings HOH Custom 13” Bottom Row (Left to Right) - Grace Glove Company 12.5” - Aria Strawberry Glove 12.5” - A2000 Super Skin 13” - Rawlings CG Elite 13” 1B Mitt - Spiderz Karma 13” |
2023.03.29 19:28 PlayWithFire- Help with how to force DWM.exe and other core Windows processes to use discrete GPU? Dell Precision 5560 laptop very unresponsive and slow in normal Windows use with no hardware switch to swap integrated graphics to discrete GPU.
2023.03.29 18:11 baineteo Mobile Workstation with Active Pen Support
2023.03.26 06:59 Harklein-2nd First time doing a custom water loop. 1 checked off of my bucket list
![]() | submitted by Harklein-2nd to watercooling [link] [comments] Before converting to a custom water loop I'm using a DeepCool Castle 240EX White along with x6 TF120S as case fans After converting to custom water loop Parts List Fittings:
Reservoir:
Pump:
Radiator:
Blocks:
Plugs and Valves:
Extras:
Fluid: 1400mL Barrow SLYS-V3 Transparent Coolant Case: Lian Li Lancool II Mesh C Performance Fans: x6 DeepCool Gamerstorm TF120S (connected to the case's built-in fan switch) PC Specs: Processor: Ryzen 7 3700X Motherboard: B450 Aorus Pro Wifi GPU: Zotac 12GB RTX 3080 Amp Holo RAM: 32GB x4 8GB PNY XLR8 DDR4-3200 CL16 PSU: 850W MSI A850GF 80+ Gold Storage: 1TB Kingston A2000 for main OS drive & 2TB Kingston NV1 for mass storage Extras: Lian Li Lancool II-2X LED Stripe Context: My first time doing a custom water loop. Other than the fluid, everything is Bykski branded only because I live in the Philippines and shipping EK or Corsair branded products from the US or EU would cost me x2.5-x5 the cost of everything I spent and I would have to wait 30 days for it to arrive hoping everything works just fine. Simply put there's a lot of risk involve and the cost is too much to consider. Everything is shipped from China. I did my research and watched a lot of build videos on YouTube. Kind of messed up with the reservoir size. I ordered before I even measured the height clearance because the Lancool II is a pretty big case and I thought it would fit the usual layout but it didn't that's why the pump is located right under the GPU block since it's the only place it would fit. I used the Male-to-Male fitting to connect the pump and the GPU block. It's a good learning experience and I would probably do another build in the future but on an ITX size this time. I still have a lot of soft tubes and fittings by the end of this build that can accommodate for another one. Even with the coolant I ended up using probably around 600mL overall. I would like to thank this subreddit for having a support and info section. It helped quite a lot. And for the inspiring builds this community showcased. I just want to note that a simple PVC Pipe Cutter that you can find on most hardware stores around the gardening section will do to cut the soft tube pipes. You can buy the EK or Bykski cutting tools if you want but I think it would cost double for the same function. I would highly recommend against the use of knives or blades to cut the tubes. You can probably use those on a pinch. Total Research Time = approx. 4 months Total Build Time Upon Arrival of Parts = 12 days Total Cost = PHP23,036.88 or US$424.35 converted with an exchange rate of PHP54.29 per US$1 at the time of this post. *Shipping is free so I didn't include any. |
2023.03.24 01:35 JustThatGuy03 750w vs 850w, what's my best bet?
2023.03.10 13:14 AstralJaegerBot [HIGH] CVE Report on March 10, 2023 12:14
No. | Status | Affected | Description |
---|---|---|---|
CVE-2020-1416 | Analyzed | Microsoft:Typescript:; Microsoft:Visual Studio 2019:16.1—16.4.11; Microsoft:Visual Studio 2017:15.0—15.9.25; Microsoft:Visual Studio 2019:16.0—16.0.16; Microsoft:Visual Studio 2019:16.5—16.6.4; Microsoft:Azure Storage Explorer:; Microsoft:Visual Studio Code:1.47.1 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'. |
CVE-2022-45688 | Analyzed | Hutool:5.8.10; Json-Java Project:Json-Java:20230227 | A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data. |
CVE-2023-20050 | Analyzed | Cisco:Nexus 6001P:; Cisco:Mds 9216A:; Cisco:Nexus 3064-32T:; Cisco:Nexus 3064-T:; Cisco:Nexus 3172Tq-32T:; Cisco:Nexus 3264Q:; Cisco:Mds 9140:; Cisco:Nexus 3264C-E:; Cisco:Mds 9500:; Cisco:Nexus 3600:; Cisco:Nexus 9000V:; Cisco:Nexus 3524-Xl:; Cisco:Nexus 34200Yc-Sm:; Cisco:Nx-Os:8.2(9); Cisco:Nexus 3500:; Cisco:Mds 9200:; Cisco:Nexus 1000 Virtual Edge:; Cisco:Mds 9718:; Cisco:Nexus 31108Tc-V:; Cisco:Mds 9148S:; Cisco:Mds 9148:; Cisco:Nexus 7018:; Cisco:Nexus 3132Q-Xl:; Cisco:Nexus 3164Q:; Cisco:Nexus 3100V:; Cisco:Nexus 3100-Z:; Cisco:Nexus 7009:; Cisco:Nexus 3100-V:; Cisco:Nexus 3400:; Cisco:Nexus 5624Q:; Cisco:Nexus 5672Up-16G:; Cisco:Nexus 3048:; Cisco:Nx-Os:; Cisco:Nexus 3172Pq:; Cisco:Nexus 3172Tq:; Cisco:Mds 9700:; Cisco:Nexus 31108Pc-V:; Cisco:Nexus 5696Q:; Cisco:Nexus 3132Q-V:; Cisco:Nexus 3172Pq/Pq-Xl:; Cisco:Mds 9710:; Cisco:Nexus 7700:; Cisco:Mds 9222I:; Cisco:Nexus 6001:; Cisco:Mds 9396S:; Cisco:Nexus 7000:; Cisco:Nexus 31108Pv-V:; Cisco:Nexus 6004:; Cisco:Nexus 7010:; Cisco:Mds 9132T:; Cisco:Mds 9100:; Cisco:Nexus 3548-X/Xl:; Cisco:Nexus 3064T:; Cisco:Nexus 3548:; Cisco:Nexus 56128P:; Cisco:Nexus 3636C-R:; Cisco:Nexus 3132C-Z:; Cisco:Nexus 3132Q-X/3132Q-Xl:; Cisco:Nexus 3524-X:; Cisco:Nexus 1000V:; Cisco:Nexus 3172Pq-Xl:; Cisco:Nexus 6000:; Cisco:Nexus 3408-S:; Cisco:Nexus 3464C:; Cisco:Nexus 3064X:; Cisco:Nexus 34180Yc:; Cisco:Nexus 3132Q:; Cisco:Nexus 3064-X:; Cisco:Nexus 3132Q-X:; Cisco:Nexus 6001T:; Cisco:Nexus 7706:; Cisco:Nexus 31128Pq:; Cisco:Nexus 9000:; Cisco:Nexus 3232C:; Cisco:Nexus 7004:; Cisco:Nexus 3016:; Cisco:Nexus 6004X:; Cisco:Mds 9506:; Cisco:Mds 9250I:; Cisco:Mds 9509:; Cisco:Nexus 7718:; Cisco:Nexus 3064:; Cisco:Nexus 5596T:; Cisco:Mds 9000:; Cisco:Nexus 5548P:; Cisco:Nexus 3548-X:; Cisco:Nexus 3524-X/Xl:; Cisco:Nexus 5596Up:; Cisco:Nexus 3548-Xl:; Cisco:Nexus 7702:; Cisco:Nexus 7710:; Cisco:Mds 9396T:; Cisco:Nx-Os:9.3(10); Cisco:Nexus 3100:; Cisco:Mds 9513:; Cisco:Nexus 3200:; Cisco:Nx-Os:10.2(4); Cisco:Nexus 5600:; Cisco:Nexus 3524:; Cisco:Mds 9148T:; Cisco:Mds 9134:; Cisco:Nexus 3432D-S:; Cisco:Nexus 5500:; Cisco:Nexus 3232C __:; Cisco:Nexus 5548Up:; Cisco:Nexus 3016Q:; Cisco:Nexus 3172:; Cisco:Mds 9706:; Cisco:Nexus 5672Up:; Cisco:Mds 9216I:; Cisco:Nexus 3172Tq-Xl:; Cisco:Nexus 36180Yc-R:; Cisco:Mds 9216:; Cisco:Nexus 5648Q__: | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user. |
CVE-2022-43459 | Analyzed | Captainform: | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. |
CVE-2023-24419 | Analyzed | Strategy11:Formidable Form Builder:5.5.7 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions. |
CVE-2023-0461 | Analyzed | Linux Kernel:6.2 | There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c |
CVE-2023-23689 | Analyzed | Dell:H5600 Firmware:9.3.0.0; Dell:H600 Firmware:9.1.0.0; Dell:F810 Firmware:9.1.0.0; Dell:A200 Firmware:9.1.0.0; Dell:A200:; Dell:H400 Firmware:9.0.0.0; Dell:H400 Firmware:9.1.0.0; Dell:H400 Firmware:9.4.0.0; Dell:H5600 Firmware:9.0.0.0; Dell:F800 Firmware:9.2.0.0; Dell:F800:; Dell:A2000 Firmware:9.1.0.0; Dell:F810 Firmware:9.4.0.0; Dell:F800 Firmware:9.4.0.0; Dell:A200 Firmware:9.2.1.0; Dell:A2000 Firmware:9.2.1.0; Dell:H600 Firmware:9.5.0.0; Dell:H400:; Dell:H500 Firmware:9.2.0.0; Dell:H500 Firmware:9.3.0.0; Dell:A200 Firmware:9.0.0.0; Dell:H500 Firmware:9.0.0.0; Dell:H5600 Firmware:9.2.0.0; Dell:F800 Firmware:9.3.0.0; Dell:H500:; Dell:A200 Firmware:9.5.0.0; Dell:F800 Firmware:9.1.0.0; Dell:A2000 Firmware:9.3.0.0; Dell:H600 Firmware:9.0.0.0; Dell:H600 Firmware:9.2.0.0; Dell:H400 Firmware:9.5.0.0; Dell:A200 Firmware:9.3.0.0; Dell:H5600:; Dell:F800 Firmware:9.5.0.0; Dell:F810 Firmware:9.5.0.0; Dell:A2000 Firmware:9.0.0.0; Dell:H400 Firmware:9.2.0.0; Dell:H500 Firmware:9.1.0.0; Dell:H600 Firmware:9.3.0.0; Dell:F810 Firmware:9.2.0.0; Dell:F810 Firmware:9.2.1.0; Dell:H500 Firmware:9.4.0.0; Dell:H5600 Firmware:9.4.0.0; Dell:H600 Firmware:9.4.0.0; Dell:H400 Firmware:9.2.1.0; Dell:H500 Firmware:9.5.0.0; Dell:A2000:; Dell:A2000 Firmware:9.5.0.0; Dell:H600:; Dell:H500 Firmware:9.2.1.0; Dell:F800 Firmware:9.2.1.0; Dell:F810 Firmware:9.3.0.0; Dell:F810:; Dell:F800 Firmware:9.0.0.0; Dell:A200 Firmware:9.2.0.0; Dell:A2000 Firmware:9.2.0.0; Dell:H400 Firmware:9.3.0.0; Dell:F810 Firmware:9.0.0.0; Dell:H600 Firmware:9.2.1.0; Dell:H5600 Firmware:9.1.0.0; Dell:H5600 Firmware:9.2.1.0; Dell:H5600 Firmware:9.5.0.0; Dell:A2000 Firmware:9.4.0.0; Dell:A200 Firmware:9.4.0.0 | Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption vulnerability. This may allow an unauthenticated network host to impair built-in hardware management functionality and trigger OneFS data protection mechanism causing a denial of service. |
CVE-2023-25540 | Analyzed | Dell:Emc Powerscale Onefs:9.4.0.0 | Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability to overwrite arbitrary files causing denial of service. |
CVE-2022-41723 | Analyzed | Golang:Go:1.20.0; Golang:Go:1.19.6; Golang:Hpack:0.7.0; Golang:Http2:0.7.0 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. |
CVE-2022-41724 | Analyzed | Golang:Go:1.20.0; Golang:Go:1.19.6 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). |
CVE-2022-41725 | Analyzed | Golang:Go:1.20.0; Golang:Go:1.19.6 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader. |
CVE-2023-1017 | Analyzed | Trustedcomputinggroup:Trusted Platform Module:2.0 | An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. |
CVE-2023-27371 | Analyzed | Gnu:Libmicrohttpd:0.9.76 | GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. |
CVE-2023-1105 | Analyzed | Flatpress:2022-12-25 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2021-3855 | Analyzed | Liman:Port Mys:1.7.0—1.8.3-462 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.This issue affects Liman MYS: from 1.7.0 before 1.8.3-462. |
CVE-2021-4326 | Analyzed | Linuxfoundation:Zowe:1.16.0—1.28.2; Linuxfoundation:Zowe:2.0.0—2.5.0 | A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI. |
CVE-2022-27677 | Analyzed | Amd:Ryzen Master:2.10.1.2287 | Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user. |
CVE-2023-22758 | Analyzed | Arubanetworks:Arubaos:10.3.0.0; Arubanetworks:Arubaos:8.10.0.0; Arubanetworks:Sd-Wan:8.7.0.0-2.3.0.0; Arubanetworks:Arubaos:8.6.0.0 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS. |
CVE-2023-26281 | Analyzed | Ibm:Http Server:8.5.0.0; Linux Kernel:; Microsoft:Windows:; Hp-Ux:; Ibm:Z/Os:; Ibm:Aix:; Oracle:Solaris: | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296. |
CVE-2023-25222 | Analyzed | Gnu:Libredwg:0.12.5 | A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c. |
CVE-2023-23003 | Analyzed | Linux Kernel:5.16 | In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value. |
CVE-2020-5001 | Analyzed | Ibm:Financial Transaction Manager:3.2.0 | IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 192953. |
CVE-2020-5026 | Analyzed | Ibm:Financial Transaction Manager:3.2.0.0 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 193662. |
CVE-2023-0053 | Analyzed | Sauter-Controls:Nova 106 Eyk300F001 Firmware:; Sauter-Controls:Nova 220 Eyk220F001 Firmware:; Sauter-Controls:Nova 106 Eyk300F001:; Sauter-Controls:Modunet300 Ey-Am300F002:; Sauter-Controls:Bacnetstac:; Sauter-Controls:Modunet300 Ey-Am300F001 Firmware:; Sauter-Controls:Modunet300 Ey-Am300F001:; Sauter-Controls:Modunet300 Ey-Am300F002 Firmware:; Sauter-Controls:Nova 230 Eyk230F001 Firmware:; Sauter-Controls:Nova 220 Eyk220F001:; Sauter-Controls:Nova 230 Eyk230F001: | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system. |
CVE-2023-0228 | Analyzed | Abb:Symphony Plus S+ Operations:2.1; Abb:Symphony Plus S+ Operations:2.2; Abb:Symphony Plus S+ Operations:3.3; Abb:Symphony Plus S+ Operations:3.0—3.3; Abb:Symphony Plus S+ Operations:2.0—2.1 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2. |
CVE-2022-38734 | Analyzed | Netapp:Storagegrid:11.6.0.8 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service. |
CVE-2023-1118 | Analyzed | Linux Kernel:6.3 | A flaw use after free in the Linux kernel integrated infrared receivetransceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. |
CVE-2023-26478 | Analyzed | Xwiki:14.3—14.4.6; Xwiki:14.5—14.9 | XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right. com.xpn.xwiki.api.Attachment should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue. |
CVE-2023-26490 | Analyzed | Mailcow\:_dockerized | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. Notably, the default ACL for a newly-created mailcow account does not include the necessary permission. The Issue has been fixed within the 2023-03 Update (March 3rd 2023). As a temporary workaround the Syncjob ACL can be removed from all mailbox users, preventing from creating or changing existing Syncjobs. |
CVE-2023-1175 | Analyzed | Vim:9.0.1378 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. |
CVE-2022-4315 | Awaiting Analysis | — | An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page. |
CVE-2023-26109 | Awaiting Analysis | — | All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. |
CVE-2023-26110 | Awaiting Analysis | — | All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. |
CVE-2023-1294 | Awaiting Analysis | — | A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_managelogin.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222648. |
CVE-2023-25573 | Awaiting Analysis | — | metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmetedownload/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
CVE-2023-25814 | Awaiting Analysis | — | metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue. |
CVE-2023-27490 | Received | — | NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details. |
CVE-2023-0050 | Received | — | An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. |
CVE-2023-20049 | Received | — | A vulnerability in the bidirectional forwarding detection (BFD) hardware offload feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of malformed BFD packets that are received on line cards where the BFD hardware offload feature is enabled. An attacker could exploit this vulnerability by sending a crafted IPv4 BFD packet to an affected device. A successful exploit could allow the attacker to cause line card exceptions or a hard reset, resulting in loss of traffic over that line card while the line card reloads. |
CVE-2022-3767 | Received | — | Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host. |
CVE-2023-22436 | Received | — | The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root. |
CVE-2022-27536 | Modified | Golang:Go:1.18.0—1.18.1; Apple:Macos: | Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. |
CVE-2022-4139 | Modified | Linux Kernel:6.1 | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. |
CVE-2023-23916 | Modified | Haxx:Curl:7.57.0—7.88.0; Debian Linux:10.0; Fedoraproject:Fedora:36; Debian Linux:11.0 | An allocation of resources without limits or throttling vulnerability exists in curl |
2023.03.10 12:59 AstralJaegerBot [HIGH] CVE Report on March 10, 2023 11:59
No. | Status | Affected | Description |
---|---|---|---|
CVE-2020-1416 | Analyzed | Microsoft:Visual Studio 2019:16.1—16.4.11; Microsoft:Visual Studio 2019:16.0—16.0.16; Microsoft:Visual Studio 2017:15.0—15.9.25; Microsoft:Visual Studio Code:1.47.1; Microsoft:Azure Storage Explorer:; Microsoft:Typescript:; Microsoft:Visual Studio 2019:16.5—16.6.4 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'. |
CVE-2022-45688 | Analyzed | Hutool:5.8.10; Json-Java Project:Json-Java:20230227 | A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data. |
CVE-2023-20050 | Analyzed | Cisco:Nexus 5548Up:; Cisco:Nx-Os:8.2(9); Cisco:Nexus 3264C-E:; Cisco:Nexus 3432D-S:; Cisco:Nexus 34200Yc-Sm:; Cisco:Nx-Os:9.3(10); Cisco:Nexus 5500:; Cisco:Nexus 31108Pc-V:; Cisco:Nexus 9000:; Cisco:Nexus 3524-Xl:; Cisco:Nexus 3100V:; Cisco:Mds 9216A:; Cisco:Nexus 3636C-R:; Cisco:Nexus 36180Yc-R:; Cisco:Nexus 3172Pq-Xl:; Cisco:Nexus 6001:; Cisco:Nexus 3200:; Cisco:Mds 9396T:; Cisco:Nexus 3548:; Cisco:Nexus 31128Pq:; Cisco:Nexus 7004:; Cisco:Nexus 3064-X:; Cisco:Mds 9132T:; Cisco:Nexus 5672Up-16G:; Cisco:Nexus 5596Up:; Cisco:Nexus 56128P:; Cisco:Nexus 5648Q:; Cisco:Nexus 31108Pv-V:; Cisco:Nexus 3464C:; Cisco:Nexus 3132Q-X/3132Q-Xl:; Cisco:Mds 9134:; Cisco:Nexus 3264Q:; Cisco:Mds 9148:; Cisco:Nexus 7718:; Cisco:Nexus 3100:; Cisco:Nexus 3064:; Cisco:Nexus 3064T:; Cisco:Mds 9718:; Cisco:Nexus 5672Up:; Cisco:Nexus 3064X:; Cisco:Nexus 3524-X:; Cisco:Nexus 7010:; Cisco:Nexus 3172Tq:; Cisco:Mds 9506:; Cisco:Nexus 3132Q-V:; Cisco:Nexus 7710:; Cisco:Mds 9710:; Cisco:Mds 9500:; Cisco:Nexus 3132Q-X:; Cisco:Nexus 6001P:; Cisco:Nexus 6004:; Cisco:Nexus 1000V:; Cisco:Nexus 7018:; Cisco:Nexus 3600:; Cisco:Nexus 5548P:; Cisco:Nexus 31108Tc-V:; Cisco:Nexus 3132C-Z:; Cisco:Nexus 1000 Virtual Edge:; Cisco:Nexus 3548-X/Xl:; Cisco:Nexus 3232C __:; Cisco:Nexus 6000:; Cisco:Nx-Os:10.2(4); Cisco:Mds 9509:; Cisco:Nexus 5624Q:; Cisco:Nexus 3132Q-Xl:; Cisco:Nexus 6001T:; Cisco:Nexus 3400:; Cisco:Nexus 5596T:; Cisco:Nexus 6004X:; Cisco:Nexus 3100-V:; Cisco:Mds 9200:; Cisco:Nexus 3524:; Cisco:Nexus 7702:; Cisco:Nexus 3500:; Cisco:Nexus 3524-X/Xl:; Cisco:Nexus 7706:; Cisco:Nexus 3164Q:; Cisco:Mds 9148T:; Cisco:Nexus 7700:; Cisco:Mds 9216I:; Cisco:Nexus 3172Pq/Pq-Xl:; Cisco:Mds 9250I:; Cisco:Mds 9700:; Cisco:Nexus 5696Q:; Cisco:Nexus 9000V:; Cisco:Nexus 3172Tq-Xl:; Cisco:Mds 9513:; Cisco:Mds 9222I:; Cisco:Mds 9216:; Cisco:Nexus 5600:; Cisco:Mds 9000:; Cisco:Nexus 3172Tq-32T:; Cisco:Nexus 34180Yc:; Cisco:Mds 9140:; Cisco:Nexus 3016:; Cisco:Nexus 7009:; Cisco:Mds 9706:; Cisco:Nexus 3064-32T:; Cisco:Nexus 3548-Xl:; Cisco:Mds 9396S:; Cisco:Nexus 3172:; Cisco:Nexus 3408-S:; Cisco:Nexus 7000:; Cisco:Mds 9100:; Cisco:Nexus 3132Q:; Cisco:Nexus 3232C:; Cisco:Nexus 3048:; Cisco:Nexus 3172Pq:; Cisco:Nx-Os:; Cisco:Mds 9148S:; Cisco:Nexus 3548-X:; Cisco:Nexus 3064-T:; Cisco:Nexus 3016Q:; Cisco:Nexus 3100-Z__: | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user. |
CVE-2022-43459 | Analyzed | Captainform: | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. |
CVE-2023-24419 | Analyzed | Strategy11:Formidable Form Builder:5.5.7 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions. |
CVE-2023-0461 | Analyzed | Linux Kernel:6.2 | There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c |
CVE-2023-23689 | Analyzed | Dell:H400 Firmware:9.2.1.0; Dell:H400 Firmware:9.3.0.0; Dell:F810 Firmware:9.5.0.0; Dell:H500 Firmware:9.3.0.0; Dell:A2000:; Dell:A2000 Firmware:9.4.0.0; Dell:F800 Firmware:9.1.0.0; Dell:A2000 Firmware:9.2.0.0; Dell:H5600 Firmware:9.2.0.0; Dell:H600 Firmware:9.5.0.0; Dell:A200 Firmware:9.3.0.0; Dell:A2000 Firmware:9.0.0.0; Dell:A2000 Firmware:9.1.0.0; Dell:F800 Firmware:9.3.0.0; Dell:A200:; Dell:H400:; Dell:F810 Firmware:9.2.0.0; Dell:A200 Firmware:9.1.0.0; Dell:A200 Firmware:9.2.0.0; Dell:H600:; Dell:H5600 Firmware:9.5.0.0; Dell:H600 Firmware:9.3.0.0; Dell:A2000 Firmware:9.5.0.0; Dell:H600 Firmware:9.0.0.0; Dell:F810 Firmware:9.2.1.0; Dell:H5600 Firmware:9.0.0.0; Dell:H5600 Firmware:9.2.1.0; Dell:A2000 Firmware:9.3.0.0; Dell:H400 Firmware:9.4.0.0; Dell:H5600 Firmware:9.1.0.0; Dell:F810 Firmware:9.4.0.0; Dell:H500 Firmware:9.1.0.0; Dell:F810:; Dell:H600 Firmware:9.2.0.0; Dell:H600 Firmware:9.2.1.0; Dell:H5600 Firmware:9.3.0.0; Dell:H400 Firmware:9.2.0.0; Dell:H600 Firmware:9.1.0.0; Dell:H400 Firmware:9.5.0.0; Dell:F810 Firmware:9.0.0.0; Dell:A200 Firmware:9.4.0.0; Dell:A200 Firmware:9.0.0.0; Dell:H600 Firmware:9.4.0.0; Dell:H500 Firmware:9.0.0.0; Dell:A2000 Firmware:9.2.1.0; Dell:H500 Firmware:9.2.1.0; Dell:H500 Firmware:9.5.0.0; Dell:F800 Firmware:9.2.0.0; Dell:F800:; Dell:A200 Firmware:9.2.1.0; Dell:H500:; Dell:H5600 Firmware:9.4.0.0; Dell:F800 Firmware:9.4.0.0; Dell:H400 Firmware:9.1.0.0; Dell:F800 Firmware:9.5.0.0; Dell:F810 Firmware:9.3.0.0; Dell:F800 Firmware:9.0.0.0; Dell:F800 Firmware:9.2.1.0; Dell:H5600:; Dell:H500 Firmware:9.2.0.0; Dell:H500 Firmware:9.4.0.0; Dell:F810 Firmware:9.1.0.0; Dell:A200 Firmware:9.5.0.0; Dell:H400 Firmware:9.0.0.0 | Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption vulnerability. This may allow an unauthenticated network host to impair built-in hardware management functionality and trigger OneFS data protection mechanism causing a denial of service. |
CVE-2023-25540 | Analyzed | Dell:Emc Powerscale Onefs:9.4.0.0 | Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability to overwrite arbitrary files causing denial of service. |
CVE-2022-41723 | Analyzed | Golang:Hpack:0.7.0; Golang:Go:1.19.6; Golang:Http2:0.7.0; Golang:Go:1.20.0 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. |
CVE-2022-41724 | Analyzed | Golang:Go:1.19.6; Golang:Go:1.20.0 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). |
CVE-2022-41725 | Analyzed | Golang:Go:1.19.6; Golang:Go:1.20.0 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader. |
CVE-2023-1017 | Analyzed | Trustedcomputinggroup:Trusted Platform Module:2.0 | An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. |
CVE-2023-27371 | Analyzed | Gnu:Libmicrohttpd:0.9.76 | GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. |
CVE-2023-1105 | Analyzed | Flatpress:2022-12-25 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2021-3855 | Analyzed | Liman:Port Mys:1.7.0—1.8.3-462 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.This issue affects Liman MYS: from 1.7.0 before 1.8.3-462. |
CVE-2021-4326 | Analyzed | Linuxfoundation:Zowe:2.0.0—2.5.0; Linuxfoundation:Zowe:1.16.0—1.28.2 | A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI. |
CVE-2022-27677 | Analyzed | Amd:Ryzen Master:2.10.1.2287 | Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user. |
CVE-2023-22758 | Analyzed | Arubanetworks:Arubaos:8.10.0.0; Arubanetworks:Arubaos:10.3.0.0; Arubanetworks:Sd-Wan:8.7.0.0-2.3.0.0; Arubanetworks:Arubaos:8.6.0.0 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS. |
CVE-2023-26281 | Analyzed | Linux Kernel:; Microsoft:Windows:; Ibm:Http Server:8.5.0.0; Ibm:Aix:; Ibm:Z/Os:; Oracle:Solaris:; Hp-Ux: | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296. |
CVE-2023-25222 | Analyzed | Gnu:Libredwg:0.12.5 | A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c. |
CVE-2023-23003 | Analyzed | Linux Kernel:5.16 | In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value. |
CVE-2020-5001 | Analyzed | Ibm:Financial Transaction Manager:3.2.0 | IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 192953. |
CVE-2020-5026 | Analyzed | Ibm:Financial Transaction Manager:3.2.0.0 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 193662. |
CVE-2023-0053 | Analyzed | Sauter-Controls:Bacnetstac:; Sauter-Controls:Modunet300 Ey-Am300F001:; Sauter-Controls:Nova 220 Eyk220F001 Firmware:; Sauter-Controls:Nova 106 Eyk300F001 Firmware:; Sauter-Controls:Nova 220 Eyk220F001:; Sauter-Controls:Modunet300 Ey-Am300F001 Firmware:; Sauter-Controls:Modunet300 Ey-Am300F002 Firmware:; Sauter-Controls:Modunet300 Ey-Am300F002:; Sauter-Controls:Nova 230 Eyk230F001:; Sauter-Controls:Nova 106 Eyk300F001:; Sauter-Controls:Nova 230 Eyk230F001 Firmware: | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system. |
CVE-2023-0228 | Analyzed | Abb:Symphony Plus S+ Operations:2.1; Abb:Symphony Plus S+ Operations:2.0—2.1; Abb:Symphony Plus S+ Operations:3.0—3.3; Abb:Symphony Plus S+ Operations:3.3; Abb:Symphony Plus S+ Operations:2.2 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2. |
CVE-2022-38734 | Analyzed | Netapp:Storagegrid:11.6.0.8 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service. |
CVE-2023-1118 | Analyzed | Linux Kernel:6.3 | A flaw use after free in the Linux kernel integrated infrared receivetransceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. |
CVE-2023-26478 | Analyzed | Xwiki:14.3—14.4.6; Xwiki:14.5—14.9 | XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right. com.xpn.xwiki.api.Attachment should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue. |
CVE-2023-26490 | Analyzed | Mailcow\:_dockerized | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. Notably, the default ACL for a newly-created mailcow account does not include the necessary permission. The Issue has been fixed within the 2023-03 Update (March 3rd 2023). As a temporary workaround the Syncjob ACL can be removed from all mailbox users, preventing from creating or changing existing Syncjobs. |
CVE-2023-1175 | Analyzed | Vim:9.0.1378 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. |
CVE-2022-4315 | Awaiting Analysis | — | An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page. |
CVE-2023-26109 | Awaiting Analysis | — | All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. |
CVE-2023-26110 | Awaiting Analysis | — | All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. |
CVE-2023-1294 | Awaiting Analysis | — | A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_managelogin.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222648. |
CVE-2023-25573 | Awaiting Analysis | — | metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmetedownload/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
CVE-2023-25814 | Awaiting Analysis | — | metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue. |
CVE-2023-27490 | Received | — | NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details. |
CVE-2023-0050 | Received | — | An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. |
CVE-2023-20049 | Received | — | A vulnerability in the bidirectional forwarding detection (BFD) hardware offload feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of malformed BFD packets that are received on line cards where the BFD hardware offload feature is enabled. An attacker could exploit this vulnerability by sending a crafted IPv4 BFD packet to an affected device. A successful exploit could allow the attacker to cause line card exceptions or a hard reset, resulting in loss of traffic over that line card while the line card reloads. |
CVE-2022-3767 | Received | — | Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host. |
CVE-2023-22436 | Received | — | The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root. |
CVE-2022-27536 | Modified | Apple:Macos:; Golang:Go:1.18.0—1.18.1 | Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. |
CVE-2022-4139 | Modified | Linux Kernel:6.1 | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. |
CVE-2023-23916 | Modified | Fedoraproject:Fedora:36; Haxx:Curl:7.57.0—7.88.0; Debian Linux:11.0; Debian Linux:10.0 | An allocation of resources without limits or throttling vulnerability exists in curl |
2023.02.26 10:51 Mean-Comparison2336 Catia is Using integrated graphics instead of GPU (info in comments)
![]() | submitted by Mean-Comparison2336 to CATIA [link] [comments] |
2023.02.20 08:36 vivekpj PC Keeps freezing and restarting
2023.02.12 18:36 Willen17 What to upgrade on my computer?
Type | Item |
---|---|
CPU | Intel Core i5-9400F 2.9 GHz 6-Core Processor |
CPU Cooler | Cooler Master Hyper TX3 Evo 43.1 CFM CPU Cooler |
Motherboard | Asus ROG STRIX B360-F GAMING ATX LGA1151 Motherboard |
Memory | Kingston HyperX Fury 8 GB (2 x 4 GB) DDR4-2666 CL15 Memory |
Storage | Kingston A2000 250 GB M.2-2280 PCIe 3.0 X4 NVME Solid State Drive |
Storage | Samsung 860 Evo 500 GB 2.5" Solid State Drive |
Video Card | Gainward Ghost GeForce GTX 1660 SUPER 6 GB Video Card |
Case | Corsair Carbide Series SPEC-DELTA RGB ATX Mid Tower Case |
Power Supply | Cooler Master B500 ver.2 500 W 80+ Certified ATX Power Supply |
Operating System | Microsoft Windows 10 Home OEM - DVD 64-bit |
Monitor | BenQ GW2250 21.5" 1920 x 1080 Monitor |
Generated by PCPartPicker 2023-02-12 12:35 EST-0500 |
2023.02.07 00:26 SorganMtanley SFF Case for Day Trading Support 6+ 4K monitors