9686 matches found
PT-2023-20116
Name of the Vulnerable Software and Affected Versions Vaadin versions 10.0.0 through 10.0.23 Vaadin versions 11.0.0 through 14.10.1 Vaadin versions 15.0.0 through 22.0.28 Vaadin versions 23.0.0 through 23.3.13 Vaadin versions 24.0.0 through 24.0.6 Vaadin versions 24.1.0.alpha1 through 24.1.0.rc2...
CVE-2023-25500: Exposure of Sensitive Information to an Unauthorized Actor
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...
Possible information disclosure of class and method names in RPC response
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests. See CWE-1295:...
Remote Code Execution (RCE)
xxl-rpc-core is vulnerable to Remote Code Execution. The vulnerability exists because the server and client will invoke the pre-configured serialization processor for deserialization in the decode function of NettyDecoder.java without input validation, leading to remote code execution...
CVE-2023-29369
Technical details about CVE-2023-29369 are not provided in the supplied documents; no affected products, root cause, or remediation are disclosed here. Monitor for updates from official advisories and connected sources as they become available.
CVE-2023-29369 Remote Procedure Call Runtime Denial of Service Vulnerability
...
CVE-2023-29369 Remote Procedure Call Runtime Denial of Service Vulnerability
...
CVE-2023-1428
A flaw was found in the gRPC library. Affected versions of this package are vulnerable to a reachable assertion, causing the abort function to be called and resulting in a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options do not mee...
LES (Light Ethereum Subprotocol) doesn't forward the transaction to the sequencer
Lines of code Vulnerability details Impact LES Light Ethereum Subprotocol doesn't forward the transaction to the sequencer when receiving it over RPC. Proof of Concept When a user submits a transaction to op-geth node validator/verfier mode, the node sends the transaction to the sequencer, if no...
GRPC security vulnerabilities
gRPC is a modern, open source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC that stems from the fact that when the gRPC HTTP2 stack throws a header size exceeded error, it skips parsing the rest of the HPACK frame. This causes...
Amazon Linux 2 : xmlrpc (ALAS-2023-2080)
It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory. An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC aka ws-xmlrpc library. A malicious XML-RPC server could target a XML-RPC clie...
xxl-rpc deserialization vulnerability
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...
cn.centychen:xxl-job-spring-boot-starter (>=1.0.0-release, <=1.0.1-release), cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.2_zzlh) +31 more potentially affected by CVE-2023-33496 via com.xuxueli:xxl-rpc-core (>=1.2.0, <=1.6.0)
com.xuxueli:xxl-rpc-core MAVEN version =1.2.0, =1.0.0-release, =2.2.1zzlh, =2.2.1zzlh, =1.1.1, =2.1.1-release, =0.0.1, =0.0.1, =2.0.4, =2.0.4, =0.0.1, =2.0.5 and more Source cves: CVE-2023-33496 Source advisory: GHSA-C29G-Q3H3-MWCF...
cn.centychen:xxl-job-spring-boot-starter (>=1.0.0-release, <=1.0.1-release), cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.2_zzlh) +31 more potentially affected by CVE-2023-33496 via com.xuxueli:xxl-rpc-core (>=1.2.0, <=1.6.0)
com.xuxueli:xxl-rpc-core MAVEN version =1.2.0, =1.0.0-release, =2.2.1zzlh, =2.2.1zzlh, =1.1.1, =2.1.1-release, =0.0.1, =0.0.1, =2.0.4, =2.0.4, =0.0.1, =2.0.5 and more Source cves: CVE-2023-33496 Source advisory: OSV:GHSA-C29G-Q3H3-MWCF...
GHSA-C29G-Q3H3-MWCF xxl-rpc deserialization vulnerability
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...
CVE-2023-33496
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...
CVE-2023-33496
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...
Deserialization of untrusted data
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode...