Lucene search
+L

3303 matches found

Amazon
Amazon
added 2024/02/05 12:00 a.m.73 views

Important: cri-tools

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

7.5CVSS6.8AI score0.01364EPSS
SaveExploits0
RedHat Linux
RedHat Linux
added 2024/01/31 4:41 p.m.14 views

opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics

A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system...

7.5CVSS7.2AI score0.01592EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2024/01/24 7:04 a.m.9 views

opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics

A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system...

7.5CVSS7.2AI score0.01592EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
added 2024/01/16 7:45 p.m.87 views

Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak.

Summary Unbound is used by IBM Robotic Process Automation for Cloud Pak as part of antivirus functionality. CVE-2019-25033. ISC BIND is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2022-3094. GNU Binutils is used by IBM Robotic Process Automation for Cloud Pak a...

9.8CVSS8.9AI score0.13213EPSS
SaveExploits3Affected Software1
Veracode
Veracode
added 2023/11/29 8:25 a.m.17 views

Denial Of Service (DOS)

github.com/knative/serving is vulnerable to Denial Of Service DOS. The vulnerability exists due to unbound memory allocation in httpscrapeclient.go which allows attackers to control the responses from the /metrics endpoint and crash the application...

6.5CVSS7AI score0.00867EPSS
SaveExploits0References5Affected Software2
OSV
OSV
added 2023/11/28 3:44 a.m.30 views

CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler

Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...

6.5CVSS6AI score
SaveExploits0References6
Cvelist
Cvelist
added 2023/11/28 3:44 a.m.38 views

CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler

Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...

6.5CVSS6.6AI score0.00867EPSS
SaveExploits0References4
GitLab Advisory Database
GitLab Advisory Database
added 2023/11/12 12:00 a.m.104 views

otelgrpc DoS vulnerability due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustio...

7.5CVSS7AI score0.01592EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 2023/11/10 7:15 p.m.14 views

AZL-34891 CVE-2023-47108 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

7.5CVSS6.8AI score0.01592EPSS
SaveExploits0References1
OSV
OSV
added 2023/11/10 7:15 p.m.12 views

AZL-34620 CVE-2023-47108 affecting package containerd for versions less than 1.7.13-3

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

7.5CVSS6.7AI score0.01592EPSS
SaveExploits0References1
OSV
OSV
added 2023/11/10 7:15 p.m.10 views

UBUNTU-CVE-2023-47108

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

7.5CVSS6.8AI score0.01592EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2023/11/10 6:31 p.m.20 views

CVE-2023-47108 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

7.5CVSS6AI score0.01592EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 2023/11/06 12:00 a.m.33 views

Rocky Linux 8 : unbound (RLSA-2022:7622)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7622 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...

6.5CVSS6.9AI score0.01052EPSS
SaveExploits0References11
Tenable Nessus
Tenable Nessus
added 2023/11/06 12:00 a.m.37 views

Rocky Linux 9 : unbound (RLSA-2022:8062)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8062 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...

6.5CVSS6.9AI score0.01052EPSS
SaveExploits0References13
Tenable Nessus
Tenable Nessus
added 2023/11/06 12:00 a.m.43 views

Rocky Linux 8 : unbound (RLSA-2021:1853)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1853 advisory. - DISPUTED Unbound before 1.9.5 allows an integer overflow in the regional allocator via regionalalloc. NOTE: The vendor disputes that this is a...

9.8CVSS7.3AI score0.02179EPSS
SaveExploits0References26
Github Security Blog
Github Security Blog
added 2023/10/16 2:01 p.m.72 views

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...

7.5CVSS7.2AI score0.01364EPSS
SaveExploits0References11Affected Software7
OSV
OSV
added 2023/10/16 2:01 p.m.41 views

GHSA-RCJV-MGP8-QVMR OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...

7.5CVSS8.9AI score0.01364EPSS
SaveExploits0References11
GitLab Advisory Database
GitLab Advisory Database
added 2023/10/16 12:00 a.m.40 views

Allocation of Resources Without Limits or Throttling

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

7.5CVSS6.2AI score0.01364EPSS
SaveExploits0References10Affected Software1
Veracode
Veracode
added 2023/10/13 12:27 p.m.29 views

Denial Of Service

opentelemetry-go-contrib is vulnerable to Denial of Service. The handler wrapper adds labels that have unbound cardinality. An attacker can send malicious requests which leads to a memory exhaustion...

7.5CVSS7AI score0.01364EPSS
SaveExploits0References10Affected Software2
Cvelist
Cvelist
added 2023/10/12 4:33 p.m.76 views

CVE-2023-45142 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

7.5CVSS7.7AI score0.01364EPSS
SaveExploits0References9
Rows per page
Query Builder