CVE-2023-28856 `HINCRBYFLOAT` can be used to crash a redis-server process

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised ...

CVE-2023-28856

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised ...

CVE-2023-28856

CVE-2023-28856 affects Redis where an authenticated user can use the HINCRBYFLOAT command to create an invalid hash field that will crash the Redis server on access. The issue is fixed in Redis releases 7.0.11, 6.2.12, and 6.0.19. Affected product: Redis server (in-memory DB with on-disk persiste...

SUSE CVE-2023-28856

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised ...

Fortinet FortiPresence Authentication Error Vulnerability

Fortinet FortiPresence is a comprehensive data analytics solution from Fortinet, Inc. Fortinet FortiPresence suffers from an authentication error vulnerability that stems from a lack of authentication for critical functions, which can be exploited by an attacker to gain access to Redis and MongoD...

PT-2023-3517

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.0.19 Redis versions prior to 6.2.12 Redis versions prior to 7.0.11 Description: The issue is related to insufficient input validation in the Redis database management system. Exploitation of this issue can allow a...

CVE-2023-28856

A vulnerability was found in Redis. This flaw allows authenticated users to use the HINCRBYFLOAT command to create an invalid hash field that may crash Redis on access...

Redis 安全漏洞

Redis Labs Redis is Redis Labs, Inc. is a set of open source written in ANSI C, network-enabled, memory-based can also be persistent log-type, key-value Key-Value storage database, and provides a variety of languages API. A security vulnerability exists in Redis versions 7.0.0 through 7.0.10, 6.2...

ROS-20230417-01

The vulnerability in Redis database is related to integer overflow in "SRANDMEMBER" commands, "ZRANDMEMBER" and "HRANDFIELD." Exploitation of the vulnerability could allow an attacker to pass specially specially crafted data into an application, cause an integer overflow, and trigger a...

redis -- HINCRBYFLOAT can be used to crash a redis-server process

Redis core team reports: Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that may later crash Redis on access...

FreeBSD : py39-redis -- can send response data to the client of an unrelated request (8aa6340d-e7c6-41e0-b2a3-3c9e9930312a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8aa6340d-e7c6-41e0-b2a3-3c9e9930312a advisory. - redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis...

FreeBSD : py39-redis -- can send response data to the client of an unrelated request (3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1)

"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3f6d6181-79b2-4d33-bb1e-5d3f9df0c1d1 advisory. - redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an...

The vulnerability of the comprehensive data analysis solution for FortiPresence, related to the lack of authentication for critical functions, allows attackers to gain access to Redis and MongoDB instances.

The vulnerability of the FortiPresence user traffic analysis integrated solution lies in the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to Redis and MongoDB instances by sending specially crafte...

CVE-2022-41331

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

CVE-2022-41331

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

Authentication flaw

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

CVE-2022-41331

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

CVE-2022-41331

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

The vulnerability of the Redis database management system, related to the lack of measures for cleaning incoming data, allows a attacker to send a specially crafted MSETNX command, causing a service failure and terminating the Redis server process.

The vulnerability of the Redis database management system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows an attacker to send a specially crafted MSETNX command, causing a service failure and terminating the Redis server process...

FortiPresence - Unpassworded remotely accessible Redis & MongoDB

A missing authentication for critical function vulnerability CWE-306 in FortiPresence on-prem infrastructure server may allow a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...