CVE-2024-10125

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125 Lack of JWT issuer and signer validation

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125

CVE-2024-10125 concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore middleware used with ALB OpenID Connect in ASP.NET Core deployments. The root cause is that JWT handling performs signature validation but fails to validate the JWT issuer and signer identity, enabling a signed token f...

Exploit for CVE-2024-48914

This post is a research article published by EQSTLabhttps://g...

CVE-2024-21536

A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service DoS due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain path...

DDMQ 授权问题漏洞

DDMQ is a distributed messaging middleware open-sourced by China's Dripping DiDi. An authorization issue vulnerability exists in DDMQ version 1.0, which stems from incorrect input manipulation by the console module, which can lead to incorrect authentication...

Denial of service in http-proxy-middleware

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

@amazeelabs/publisher (>=2.4.28, <=2.5.8), @angular-devkit/build-angular (>=18.0.0-next.3, <=19.0.0-next.9) +65 more potentially affected by CVE-2024-21536 via http-proxy-middleware (>=3.0.0, <=3.0.2)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =3.11.0-beta.6, =1.1.0, =0.0.26, =0.0.26, =8.0.0-canary.984, =9.0.0-canary.203 and more...

@alfresco/adf-testing (6.0.0-A.2-8258), @aller/svelte-components (>=1.5.1, <=1.5.17) +207 more potentially affected by CVE-2024-21536 via http-proxy-middleware (>=2.0.0, <=2.0.6)

http-proxy-middleware NPM version =2.0.0, =1.5.1, =2.0.0, =17.0.0-next.0, =9.3.0, =2.3.1, =1.92.0, =1.0.1, =1.0.10, =1015.132.0, =0.0.1, =1.2.0, =0.1.0, =0.1.5 and more Source cves: CVE-2024-21536 Source advisory: OSV:GHSA-C7QV-Q95Q-8V27...

GHSA-C7QV-Q95Q-8V27 Denial of service in http-proxy-middleware

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

CVE-2024-21536

CVE-2024-21536 affects http-proxy-middleware: versions before 2.0.7, and 3.0.0–before 3.0.3, are vulnerable to DoS due to an unhandled rejection in micromatch that can crash a Node.js server. The fix is in 2.0.7 (and 3.x later 3.0.3). Remediate by upgrading to a version containing the fix (e.g., ...

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths...

http-proxy-middleware 安全漏洞

http-proxy-middleware is Node.js http proxy middleware for connect, express, next.js, and more. A security vulnerability exists in http-proxy-middleware versions prior to 2.0.7 and versions 3.0.0 through 3.0.3. An attacker exploiting this vulnerability could cause a system crash...

Origin Validation Error

gradio is vulnerable to Origin Validation Error. The vulnerability is due to the CustomCORSMiddleware class. An attacker can make unauthorized requests and potentially access sensitive data...

@alfresco/adf-testing (6.0.0-A.2-8258), @aller/svelte-components (>=1.5.1, <=1.5.17) +207 more potentially affected by CVE-2024-21536 via http-proxy-middleware (>=2.0.0, <=2.0.6)

http-proxy-middleware NPM version =2.0.0, =1.5.1, =2.0.0, =17.0.0-next.0, =9.3.0, =2.3.1, =1.92.0, =1.0.1, =1.0.10, =1015.132.0, =0.0.1, =1.2.0, =0.1.0, =0.1.5 and more Source cves: CVE-2024-21536 Source advisory: SNYK:JS-HTTPPROXYMIDDLEWARE-8229906...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths. PoC 1 Run a server like this: js const express =...