770 matches found
What To Do When You’re Under a DDoS Attack: A Guide to Action
...
Denial Of Service (DoS)
Kube-controller-manager is vulnerable to denial of service. The vulnerability is due to a missing .spec.behavior.scaleUp block in the HPA YAML file, causing kube-controller-manager pods to enter a restart loop and disrupt service availability. It allows an attacker to trigger a DoS by deploying t...
python-tornado: Tornado has HTTP cookie parsing DoS vulnerability
A flaw was found in Tornado's HTTP cookie parsing algorithm. This vulnerability allows excessive CPU consumption via maliciously crafted cookie headers due to Quadratic complexity, potentially blocking the processing of other requests and leading to the loss of availability of the system...
Linux gsm_cleanup_mux Heap Buffer Overflow
The vulnerability of the gsmcleanupmux function in the drivers/tty/ngsm.c kernel module of the Linux operating system is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...
Apache ZooKeeper Authentication Bypass Vulnerability
Apache ZooKeeper is a centralized service under the Apache Software Foundation for maintaining configuration information, naming, providing distributed synchronization, and providing group services. An authentication bypass vulnerability exists in Apache ZooKeeper versions prior to 3.9.3. The...
Apache ZooKeeper 3.9.x < 3.9.3 Authentication Bypass
The version of Apache ZooKeeper listening on the remote host is 3.9.x prior to 3.9.3. It is, therefore, affected by an authentication bypass vulnerability: - When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only...
CVE-2024-51504
An authentication bypass vulnerability was found in Apache Zookeeper. The default configuration of the client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication by spoofing the client's IP address in request...
GHSA-G93M-8X6H-G5GV Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
CVE-2024-51504
The ZooKeeper Admin Server is vulnerable to an Authentication Bypass by Spoofing (CWE-290) due to a weak default configuration in the IPAuthenticationProvider . Specifically, the provider honors the X-Forwarded-For HTTP request header, which can be easily spoofed by an attacker to bypass IP-based...
CVE-2024-51504
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...
6 Steps for Cyber Resilience During the 2024 U.S. Presidential Election
Learn about the risks to service availability during the 2024 U.S. presidential election — and the six steps you can take now to ensure your cyber resilience...
D-Link DIR-605L Router formSetEnableWizard Function Use-After-Free
The vulnerability of the formSetEnableWizard /goform/formSetEnableWizard function in D-Link DIR-605L router microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...
Linux kernel hwmon driver Data Compromise
The vulnerability of the functions tcrit1store and tcrit2store in the driver hwmon/lm95234.c of the Linux kernel’s hardware monitoring driver is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of th...
Security Bulletin: Denial of service and server-side request forgery might affect IBM Storage Defender – Resiliency Service
Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-39249, CVE-2024-39338 Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of...
Denial Of Service (DoS)
Microsoft.AspNetCore.App.Runtime is vulnerable to a Denial of Service DoS vulnerability. The vulnerability is due to a specific condition or action that allows an attacker to disrupt service availability...
CVE-2024-42038
Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability...
Security Bulletin: Denial of service and remote code execution might affect IBM Storage Defender – Resiliency Service
Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-6387, CVE-2024-39329, CVE-2024-38875, CVE-2024-39614, CVE-2024-39330, CVE-2024-21520, CVE-2024-39689,...
Tenda F1202 fromNatlimit Function Use-After-Free
The vulnerability of the fromNatlimit function /goform/Natlimit in the Tenda F1202 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected informatio...