1276 matches found
Envoy integer overflow vulnerability
Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations...
CVE-2021-28682
CVE-2021-28682 affects Envoy (through 1.71.1) with a remotely exploitable integer overflow triggered by an extremely large grpc-timeout value that leads to incorrect timeout calculations. The vulnerability details are corroborated across connected sources (BIT-ENVOY-2021-28682, OSV entries) and s...
Prototype Pollution
Overview "The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition." Recommendation Upgrade to version 1.1.8 or later References - CVE - GitHub Advisory...
GHSA-PP75-XFPW-37G9 Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
0.extends.wechat (>=1.0.51 <=1.0.65), 0perator (>=0.1.0 <=0.3.0) +17017 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=0.1.0 <=1.1.7)
@grpc/grpc-js NPM version =0.1.0, =1.0.51, =0.1.0, =0.1.0, =5.0.0, =1.0.0, =1.0.1, =1.0.0, =1.1.0, =0.4.0, =0.1.1, =1.0.0, =0.0.1, =1.0.0, =1.0.17 and more Source cves: CVE-2020-7768 Source advisory: OSV:GHSA-PP75-XFPW-37G9...
3architecture (>=1.0.0 <=1.7.0), 4coders-commons (>=0.0.1 <=0.0.2) +3773 more potentially affected by CVE-2020-7768 via grpc (>=0.11.1 <=1.24.3)
grpc NPM version =0.11.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.24, =0.0.1, =1.6.0, =0.0.2, =4.1.6-22, =0.0.1, =0.0.2 - @account-coddle/pokerfire =0.0.1 and more Source cves: CVE-2020-7768 Source advisory: OSV:GHSA-PP75-XFPW-37G9...
Prototype pollution in grpc and @grpc/grpc-js
"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...
envoyproxy/envoy: integer overflow handling large grpc-timeouts
A flaw was found in envoyproxy/envoy. An attacker, able to craft a packet which specifies a large grpc-timeout, can potentially cause envoy to incorrectly calculate the timeouts resulting in a denial of service. The highest threat from this vulnerability is to system availability...
Prototype Pollution in grpc/grpc-node
Description grpc native core package is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following PoC file: js // poc.js var grpc =require'grpc'...
ASB-A-170407229
In dispatchGraphTerminationMessage of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...
Photon OS 2.0: Grpc PHSA-2020-2.0-0305
An update of the grpc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0305. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144217;...
Photon OS 3.0: Grpc PHSA-2020-3.0-0176
An update of the grpc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0176. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144218;...
Important Photon OS Security Update - PHSA-2020-0176
Updates of 'grpc' packages of Photon OS have been released...
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0305
An update of 'grpc' packages of Photon OS has been released...
Critical Photon OS Security Update - PHSA-2020-3.0-0176
Updates of 'grpc' packages of Photon OS have been released...
Security Bulletin: App Connect Enterprise Certified Container is vulnerable to code injection and Denial of Service attacks
Summary App Connect Enterprise Certified Container Integration Servers and Designers are vulnerable to code injection and Denial of Service attacks due to CVE-2020-7766 and CVE-2020-7768 Vulnerability Details CVEID: CVE-2020-7768 DESCRIPTION: Node.js grpc module is vulnerable to a denial of...
CVE-2020-7768
A flaw was found in nodejs-grpc, where the package @grpc/grpc-js is vulnerable to Prototype Pollution via the loadPackageDefinition. The highest threat from this vulnerability is to system availability...