Puma HTTP Request/Response Smuggling vulnerability

Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource CPU, network bandwidth consumption. Patches The vulnerabilit...

CVE-2024-21647

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

CVE-2024-21647 HTTP Request/Response Smuggling in puma

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

CVE-2024-21647 HTTP Request/Response Smuggling in puma

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

CVE-2024-21647

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

Decoding UAC-0050’s Cyber Espionage Playbook

Summary: UAC-0050, a threat actor focused on Ukraine, is using new tactics to spread the Remcos RAT. In their latest move, UAC-0050 shows advanced adaptability by cleverly avoiding detection through a hidden data transfer method and outsmarting EDR systems. Threat Level - Amber | Attack Report Fo...

CVE-2023-47140

IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls...

CVE-2023-47140

IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls...

Improper access control

IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. IBM X-Force ID: 270259...

CVE-2023-47140

IBM CICS Transaction Gateway 9.3 (Containers) is affected by CVE-2023-47140 due to improper access controls that could allow a user to transfer or view files. The IBM Security Bulletin (CA480D0E529A...) states affected product: CICS Transaction Gateway Containers 9.3, with remediation guidance po...

Silent failure in user reward transfer in Treasury.withdrawToAccount() can lead to loss of rewards

Lines of code Vulnerability details Impact The withdrawToAccount function of the Treasury contract is designed to send ETH rewards and OLAS top-ups to a specified account. However, there is a potential issue where a user's reward transfer could silently fail. This occurs when the...

CVE-2023-47140: Incorrect Privilege Assignment

IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls...

Functions that send Ether to arbitrary destinations

Lines of code Vulnerability details Impact Unprotected call to a function sending Ether to an arbitrary address. Dangerous calls: GnosisSafe.handlePaymentuint256,uint256,uint256,address,address Tools Used Manual Auditing line by line Recommended Mitigation Steps Ensure that an arbitrary user cann...

IBM CICS Transaction Gateway 安全漏洞

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

[M2] DrainServicesSlashedFunds has not check for received funds

Lines of code Vulnerability details Impact ​ Loss of funds. Analysis of the vulnerability The function to drain funds from Service Registry is not checking that is receiving the correct amount from ServiceRegistry. /// @dev Drains slashed funds from the service registry. /// @return amount Draine...

CVE-2024-21647: Inconsistent Interpretation of HTTP Requests

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

PPLBlade - Protected Process Dumper Tool

Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...

PT-2024-13411 · Ibm · Ibm Cics Transaction Gateway

Name of the Vulnerable Software and Affected Versions: IBM CICS Transaction Gateway version 9.3 Description: The issue is related to improper access controls in IBM CICS Transaction Gateway, which could allow a user to transfer or view files. Recommendations: For IBM CICS Transaction Gateway...

ALPINE-CVE-2023-34321

Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes such as the ones during scrubbing have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the...

OESA-2024-1014 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending...