CVE-2023-37918 API token authentication bypass in HTTP endpoints in Dapr

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

CVE-2023-37918

creationtimestamp| type| source ---|---|--- 2023-07-21 17:02:33+00:00| published-proof-of-concept| https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj...

Dapr 授权问题漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. Dapr suffers from an authorization issue vulnerability that stems from allowing bypassing API token authentication, where an attacker can authenticate calls from the application via a carefully crafted HTTP request...

CVE-2023-37918: Improper Authentication

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

GHSA-9X44-9PGQ-CF45 avro vulnerable to denial of service via attacker-controlled parameter

Summary A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. Details The root cause of the issue is that avro uses part of the input to Unmarshal to...

avro vulnerable to denial of service via attacker-controlled parameter

Summary A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. Details The root cause of the issue is that avro uses part of the input to Unmarshal to...

dapr:FuzzExprDecodeString: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6375205141610496 Project: dapr Fuzzing Engine: libFuzzer Fuzz Target: FuzzExprDecodeString Job Type: libfuzzerasandapr Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

dapr:FuzzExprDecodeString: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6541370690240512 Project: dapr Fuzzing Engine: libFuzzer Fuzz Target: FuzzExprDecodeString Job Type: libfuzzerasandapr Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000044e3783b Crash State: NULL Sanitizer: address ASAN Recommended...

Dapr Dashboard Access Control Error Vulnerability

Dapr Dashboard is a web-based user interface for Dapr that allows users to view information, view logs of running Dapr applications, components, configurations, etc. Dapr Dashboard 0.1.0 and later, 0.10.0 and earlier versions have an access control error vulnerability that stems from the existenc...

Information Disclosure

Dapr dashboard is vulnerable to information disclosure. The vulnerability is due to the dashboard's access control not being properly configured, resulting in an attacker gaining access to obtain sensitive plaintext configuration of redis, mongodb, rabbitmq and other applications on the cloud...

Dapr Dashboard vulnerable to Incorrect Access Control

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

GHSA-2W6M-Q946-399R Dapr Dashboard vulnerable to Incorrect Access Control

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

Improper access control

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817

Dapr Dashboard (versions 0.1.0–0.10.0) is reported vulnerable to improper/incorrect access control that could allow attackers to obtain sensitive data, modify data, or perform unauthorized operations. The CVE-2022-38817 entry is backed by multiple sources (NVD, Red Hat, CNVD, OSV, GitHub advisori...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

CVE-2022-38817: Missing Authentication for Critical Function

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...