AZL-38503 CVE-2023-45288 affecting package cert-manager for versions less than 1.12.12-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks

New research has found that the CONTINUATION frame in the HTTP/2 protocol can be exploited to conduct denial-of-service DoS attacks. The technique has been codenamed HTTP/2 CONTINUATION Flood by security researcher Bartek Nowotarski, who reported the issue to the CERT Coordination Center CERT/CC ...

CVE-2024-21894

creationtimestamp| type| source ---|---|--- 2024-04-04 07:03:45+00:00| seen| Telegram/HJZjl4zcHzNkK9qESQes7pHD5yDJiNFx4NpOCqZMnHaQAGE 2024-04-04 07:26:12+00:00| seen| Telegram/x9KHbxgX9Frqda1uh6jS8zt0AD5sLEGypR32VYhAt0rpRA 2024-04-04 07:26:13+00:00| seen| https://t.me/tengkorakcybercrewz/4933...

CVE-2024-30859

netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configISCGroupSSLCert.php...

WordPress Responsive theme <= 5.0.2 - Missing Authorization to HMTL Injection vulnerability

Missing Authorization to HMTL Injection vulnerability discovered by Krzysztof Zając - CERT PL, Muhammad Zeeshan Xib3rR4dAr in WordPress Theme Responsive versions = 5.0.2...

NetentSec NS-ASG 安全漏洞

NetentSec NS-ASG is an application security gateway from China NetentSec. A security vulnerability exists in NetentSec NS-ASG version 6.3, which originates from an SQL injection vulnerability in the /admin/configISCGroupSSLCert.php file...

CVE-2024-0450

creationtimestamp| type| source ---|---|--- 2024-03-19 17:26:53+00:00| seen| https://t.me/ctinow/211729 2025-04-11 22:51:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11505 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

CVE-2023-6597

creationtimestamp| type| source ---|---|--- 2024-03-19 17:26:52+00:00| seen| https://t.me/ctinow/211728 2024-03-19 17:27:12+00:00| seen| https://t.me/ctinow/211745 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

Malicious code in cert-orchestration-adapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a46ccca932f3d69709f16aef0e3bc3498916b7e0b87a1d69a340ce1d65677dc4 The OpenSSF Package Analysis project identified 'cert-orchestration-adapter' @ 5.9.1 pypi as malicious. It is considered malicious because: - Th...

CVE-2024-2193

creationtimestamp| type| source ---|---|--- 2024-03-13 09:16:22+00:00| seen| https://t.me/ctinow/206483 2024-03-13 14:57:21+00:00| seen| https://t.me/itsecnews/4196 2024-03-14 11:19:45+00:00| published-proof-of-concept| https://t.me/truesecator/5520 2024-03-15 19:23:06+00:00| seen|...

CVE-2023-47534

creationtimestamp| type| source ---|---|--- 2024-03-12 16:26:38+00:00| seen| https://t.me/ctinow/205805 2024-03-12 16:32:06+00:00| seen| https://t.me/ctinow/205821 2024-03-13 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1246 2024-03-13 21:52:26+00:00| seen|...

Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens SENTRON

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: policy-controller, spire-server, temporal-ui-server, gitsign, flux-source-controller, tekton-chains, weaviate, caddy, terragrunt, grpc-health-probe, k3s, kots, tkn, apko, skopeo, slsa-verifier, dex, melange, wolfictl, zot, ko, sigstore-scaffolding, dgraph,...

AZL-35837 CVE-2024-28180 affecting package cert-manager for versions less than 1.11.2-14

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35875 CVE-2024-28180 affecting package cert-manager for versions less than 1.12.12-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...