PT-2024-21531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the igc driver in the Linux kernel, specifically with the XDP REDIRECT feature. When a frame cannot be transmitted due to a full queue, it is necessary to...

keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

CVE-2024-30656

An issue in Fireboltt Dream Wristphone BSW202FBAACv2.020240110-20240110-1956 allows attackers to cause a Denial of Service DoS via a crafted deauth frame...

CVE-2024-30656

An issue in Fireboltt Dream Wristphone BSW202FBAACv2.020240110-20240110-1956 allows attackers to cause a Denial of Service DoS via a crafted deauth frame...

CVE-2024-30656

An issue in Fireboltt Dream Wristphone BSW202FBAACv2.020240110-20240110-1956 allows attackers to cause a Denial of Service DoS via a crafted deauth frame...

CVE-2024-30656

CVE-2024-30656 concerns Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956. Connected sources confirm a Denial of Service (DoS) can be caused by a crafted deauth frame via the affected Wi‑Fi frame handling, with CVSS metrics indicating high impact to availability (NVD: AV:N/AC:L...

DEBIAN-CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting proxy.config.http2.maxcontinuationframesperminute to limit the number of CONTINUATION frames...

CVE-2024-30189

A vulnerability has been identified in SCALANCE W721-1 RJ45 6GK5721-1FC00-0AA0 All versions, SCALANCE W721-1 RJ45 6GK5721-1FC00-0AB0 All versions, SCALANCE W722-1 RJ45 6GK5722-1FC00-0AA0 All versions, SCALANCE W722-1 RJ45 6GK5722-1FC00-0AB0 All versions, SCALANCE W722-1 RJ45 6GK5722-1FC00-0AC0 Al...

SUSE CVE-2024-26707

In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARNONCE in sendhsrsupervisionframe Syzkaller reported 1 hitting a warning after failing to allocate resources for skb in hsrinitskb. Since a WARNONCE call will not help much in this case, it might be prudent to...

ALPINE-CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

UBUNTU-CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2024-20834)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. Apache Traffic Server suffers from an input validation error vulnerability that stems from continuation frame flooding in the HTTP/2 stack, which can be exploited by an attacke...

PT-2024-23544 · Fireboltt · Fireboltt Dream Wristphone

Name of the Vulnerable Software and Affected Versions: Fireboltt Dream Wristphone version BSW202 FB AAC v2.0 20240110-20240110-1956 Description: The issue allows attackers to cause a Denial of Service DoS via a crafted deauth frame. Recommendations: For Fireboltt Dream Wristphone version BSW202 F...

Denial Of Service (DOS)

golang.org/x/net is vulnerable to Denial Of Service DoS. The vulnerability is due to a lack of header frame limits, allowing an attacker to send excessive CONTINUATION frames which causes the endpoint to read arbitrary amounts of header data without proper memory allocation limits...

AZL-39334 CVE-2023-45288 affecting package cert-manager for versions less than 1.11.2-9

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-28182 Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK...