First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-5289

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
ikus060	ikus060/rdiffweb	>= unspecified, < 2.8.4

References

https://github.com/ikus060/rdiffweb/commit/06f89b43469aae70e8833e55192721523f86c5a2Patch
https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ceExploit, Patch, Third Party Advisory
https://github.com/ikus060/rdiffweb/commit/06f89b43469aae70e8833e55192721523f86c5a2Patch
https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ceExploit, Patch, Third Party Advisory

Timeline

Published: Sep 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-528904.5NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would CVE-2023-528915.3A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5),CVE-2023-528927.5In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates CVE-2023-528935.5In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables wit CVE-2023-528945.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() In G CVE-2023-528955.5In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request CVE-2023-528964.7In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointe CVE-2023-528974.7In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: do not warn on record without old_roots populated [BUG]CVE-2023-528984.7In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference when host dies Make sure xhci_free_CVE-2023-528995.5In the Linux kernel, the following vulnerability has been resolved: Add exception protection processing for vd in axi_chan_handle_err funct CVE-2023-529005.5In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 CVE-2023-529015.5In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check endpoint is valid before dereferencing it When the ho