4234 matches found
CVE-2022-33099
Lua 5.4.4 and earlier contains a heap-buffer overflow in the error handling path (CVE-2022-33099) affecting luaG_runerror (and related luaG_errormsg handling), triggered by recursive error handling. Connected advisories confirm affected packages (Lua 5.4.x family) across multiple distributions, w...
CVE-2022-33099
An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs...
CVE-2022-33099
An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs...
PT-2022-21690
Name of the Vulnerable Software and Affected Versions Lua versions prior to 5.4.4 Description An issue in the component luaG runerror of Lua leads to a heap-buffer overflow when a recursive error occurs. Recommendations For versions prior to 5.4.4, update to a version that contains a fix for this...
Lua buffer error vulnerability
Lua is a lightweight, extensible open source scripting language from the LUA team. A security vulnerability exists in Lua v5.4.4 and earlier versions, which stems from an issue in luaGrunerror that causes a heap buffer overflow in the event of a recursive error...
CVE-2022-33099: Out-of-bounds Write
An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs...
Kubernetes: RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field
A vulnerability was exploited that allowed arbitrary files to be written and executed on the ingress-nginx-controller pod through the manipulation of Ingress resource specifications. By configuring log formats and locations, malicious configurations could gain remote code execution capabilities o...
CVE-2021-44647 affecting package lua for versions less than 5.4.3-3
CVE-2021-44647 affecting package lua for versions less than 5.4.3-3. A patched version of the package is available...
OESA-2022-1718 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to...
CVE-2022-31395
Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-data.lua...
SUSE SLES12 Security Update : apache2 (SUSE-SU-2022:2101-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2101-1 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows a...
Denial Of Service (DoS)
Apache HTTP Server is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization to the input size allowing an attacker to crash the system via a malicious request to a lua script that calls r:parsebody0...
Apache HTTP Server Input Validation Error Vulnerability
Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server version 2.4.53 and earlier, which stems from a failure to...
Internet Bug Bounty: DoS via lua_read_body() [zhbug_httpd_94]
Greetings. I have found a bug that can crash httpd 2.4.53, causing a denial of service. The bug is that luareadbody modules/lua/luarequest.c uses the value of the Content-Length header to allocate memory. While apreadrequest limits Content-Length's value to a non-negative |aprofft| via a call to...
CVE-2022-28615
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in apstrcmpmatch when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use...
CVE-2022-29404
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possible input size...
ALPINE-CVE-2022-28615
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in apstrcmpmatch when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use...
DEBIAN-CVE-2022-29404
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possible input size...
CVE-2022-29404
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possible input size...
ALPINE-CVE-2022-29404
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possible input size...