2850 matches found
Cross site request forgery (csrf)
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. This could, for example, happen for a non-pipeline operation. NOTE: the solutions for CVE-2023-288...
CVE-2023-28859
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. This could, for example, happen for a non-pipeline operation. NOTE: the solutions for CVE-2023-288...
Design/Logic Flaw
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....
CVE-2023-28858
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....
PT-2023-2097
Name of the Vulnerable Software and Affected Versions redis-py versions prior to 4.5.3 Description The issue is related to the redis-py library, which leaves a connection open after canceling an async Redis command at an inopportune time, specifically in the case of a pipeline operation. This can...
CVE-2023-28858
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....
CVE-2023-28858
CVE-2023-28858 affects the Python Redis client, redis-py, for versions before 4.5.3. The issue is a connection that may remain open after canceling an async Redis command at an inopportune time, which can lead to leakage of response data to the client of an unrelated request in an off-by-one mann...
CVE-2023-28859
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. This could, for example, happen for a non-pipeline operation. NOTE: the solutions for CVE-2023-288...
PT-2023-2098
Name of the Vulnerable Software and Affected Versions redis-py versions 4.4.0 through 4.4.3 redis-py versions 4.5.0 through 4.5.3 Description The issue is related to the redis-py library for Python, which is associated with a lack of protection for service data. This could allow a remote attacker...
CVE-2023-28858
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....
CVE-2023-28858
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....
core-lib (>=0.1.0, <=0.2.0), eventsourced-nats (>=0.1.0, <=0.6.0) +26 more potentially affected by unknown CVE via async-nats (>=0.9.18, <=0.21.0)
async-nats CARGO version =0.9.18, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.26.0, =0.25.0, =0.1.0, =0.12.0-alpha.1, =0.9.0, =0.16.0, =0.21.0 - wasmcloud-example-runner 0.4.0 - wasmcloud-examples-payments 0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F5V5-CCQC-6W36...
GHSA-F5V5-CCQC-6W36 async-nats vulnerable to TLS certificate common name validation bypass
The NATS official Rust clients are vulnerable to MitM when using TLS. The common name of the server's TLS certificate is validated against the hostname provided by the server's plaintext INFO message during the initial connection setup phase. A MitM proxy can tamper with the host field's value by...
TLS certificate common name validation bypass
The NATS official Rust clients are vulnerable to MitM when using TLS. The common name of the server's TLS certificate is validated against the hostname provided by the server's plaintext INFO message during the initial connection setup phase. A MitM proxy can tamper with the host field's value by...
core-lib (>=0.1.0, <=0.2.0), eventsourced-nats (>=0.1.0, <=0.6.0) +26 more potentially affected by unknown CVE via async-nats (>=0.9.18, <=0.21.0)
async-nats CARGO version =0.9.18, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.26.0, =0.25.0, =0.1.0, =0.12.0-alpha.1, =0.9.0, =0.16.0, =0.21.0 - wasmcloud-example-runner 0.4.0 - wasmcloud-examples-payments 0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0027...
Design/Logic Flaw
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the...
CVE-2023-1544
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of...
Deno 缓冲区错误漏洞
Deno is open source a simple , modern and secure JavaScript and TypeScript runtime environment . It uses V8 and is built with Rust. A security vulnerability exists in Deno versions prior to 1.32.1, which stems from a resizable array passed to an asynchronous function being shrunk during an...
async-ssh2-tokio (>=0.2.0, <=0.4.0), russh-sftp (>=0.2.0, <=1.2.1) +1 more potentially affected by CVE-2023-28113 via russh (>=0.34.0, <=0.35.0-beta.9)
russh CARGO version =0.34.0, =0.2.0, =0.2.0, =0.1.0, =0.4.1 Source cves: CVE-2023-28113 Source advisory: OSV:GHSA-CQVM-J2R2-HWPG...
