5477 matches found
CVE-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...
Redis Labs Redis 代码注入漏洞
Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. An injection vulnerability...
redis -- Multiple vulnerabilities
Aviv Yahav reports: CVE-2022-24735 By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the potentially higher privileges of another Redis user. CVE-2022-24736 An attacker attempting to load a specially craft...
Redis Lua Sandbox Escape
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Redis Lua Sandbox Escape', 'Description' = %q This module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was...
Redis Labs Redis 代码问题漏洞
Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. A security vulnerability...
Redis Lua Sandbox Escape Exploit
This Metasploit module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was introduced by Debian and Ubuntu Redis packages that insufficiently sanitized the Lua environment. The maintainers failed to disable the package interface, allowing attackers to load arbitrary...
PT-2022-2525
Name of the Vulnerable Software and Affected Versions Redis versions prior to 6.2.7 and 7.0.0 Description The issue is related to errors in pointer dereferencing. An attacker can exploit this by loading a specially crafted Lua script, causing a NULL pointer dereference that results in a crash of...
GHSA-V2WF-C3J6-WPVW Session fixation
Impact The use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability. Workarounds Call...
CVE-2021-32627 affecting package redis for versions less than 6.2.6-1
CVE-2021-32627 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32626 affecting package redis for versions less than 6.2.6-1
CVE-2021-32626 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32762 affecting package redis for versions less than 6.2.6-1
CVE-2021-32762 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-41099 affecting package redis for versions less than 6.2.6-1
CVE-2021-41099 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32761 affecting package redis for versions less than 6.2.5-1
CVE-2021-32761 affecting package redis for versions less than 6.2.5-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32687 affecting package redis for versions less than 6.2.6-1
CVE-2021-32687 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32675 affecting package redis for versions less than 6.2.6-1
CVE-2021-32675 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-32628 affecting package redis for versions less than 6.2.6-1
CVE-2021-32628 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...
CVE-2021-3470 affecting package redis for versions less than 5.0.5-7
CVE-2021-3470 affecting package redis for versions less than 5.0.5-7. A patched version of the package is available...
CVE-2021-32672 affecting package redis for versions less than 6.2.6-1
CVE-2021-32672 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...