294 matches found
GO-2022-0969 Denial of service in net/http and golang.org/x/net/http2
HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service...
oauth2-server through 3.1.1 vulnerable to Open Redirect
In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: before making a redirection. This allows a malicious client to pass an XSS payload...
Velocidex Velociraptor 跨站脚本漏洞
Velocidex Velociraptor is a tool from Velocidex Australia that collects host-based status information using Velociraptor Query Language VQL queries. A security vulnerability exists in Velocidex Velociraptor version 0.6.5-2 that originates from allowing a user to export a collection report in HTML...
CVE-2022-2469
GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client...
GHSA-R7PQ-3X6P-7JCM Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core
A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception with a carefully crafted message...
Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core
A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception with a carefully crafted message...
Incorrect Implementation of Authentication Algorithm in OPCFoundation.NetStandard.Opc.Ua.Core
A vulnerability was discovered in the OPC UA .NET Standard Stack that - allows a malicious client or server to bypass the application authentication mechanism - and allow a connection to an untrusted peer...
GHSA-5Q2V-6J86-5H9V Security Update for the OPC UA .NET Standard Stack
A vulnerability was discovered in OPC UA .NET Standard Stack that allows a malicious client or server to cause a peer to hang with a carefully crafted message sent during secure channel creation...
Denial-of-service vulnerability processing large chat messages containing many newlines
Impact PocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by \n, and each part is treated as a separate message, the length of each...
GO-2021-0154 Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls
When SessionTicketsDisabled is enabled, crypto/tls allowed man-in-the-middle attackers to spoof clients via unspecified vectors. If the server enables TLS client authentication using certificates this is rare and explicitly sets SessionTicketsDisabled to true in the tls.Config, then a malicious...
Helm Improper Certificate Validation
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm many files updated, see...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
Oracle Linux 8 : samba (ELSA-2022-2074)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-2074 advisory. - resolves: rhbz2046127 - Fix CVE-2021-44141 - resolves: rhbz2046153 - Fix CVE-2021-44142 - resolves: rhbz2039153 - Fix CVE-2021-20316 - resolves:...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
dotnet: malicious content causes high CPU and memory usage
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...
CVE-2022-29117
A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of a malicious client that can send MyCookie=chunks-2147483647 without the actual cookie chunks, causing large allocations, exceptions, and excess CPU utilization on the server when it tries to read or delete that man...