8477 matches found
SUSE CVE-2023-39325
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
The vulnerability of the HTTP/2 protocol lies in its ability to create request streams within an already established network connection, without the need to establish new connections or confirm the receipt of packets. This allows attackers to cause service failures.
The vulnerability of the HTTP/2 protocol lies in the ability to create request streams within an already established network connection, without the need to establish new network connections or confirm the receipt of packets. Exploiting this vulnerability allows a malicious actor to cause service...
GHSA-QPPJ-FM5R-HXR3 HTTP/2 Stream Cancellation Attack
HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...
kernel: Spectre v2 SMT mitigations problem
It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes...
AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31324 CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2
Summary Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service DDoS attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability CVE-2023-44487 impacts any internet exposed HTTP/2 endpoints. As an...
PT-2023-13009 · Sinec Nms · Sinec Nms
Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V2.0 Description: A vulnerability has been identified in the affected application, where it assigns improper access rights to specific folders containing executable files and libraries. This could allow an...
ChiefOnboarding Cross-Site Request Forgery Vulnerability
ChiefOnboarding is a free and open source employee onboarding platform. A cross-site request forgery vulnerability exists in versions prior to ChiefOnboarding v2.0.47, which stems from a cross-site request forgery CSRF vulnerability in...
Delta Electronics WPLSoft Security Vulnerability
Delta Electronics WPLSoft is a software tool for programming Delta Programmable Logic Controllers PLCs from Delta Electronics, Inc. of Taiwan, China. A security vulnerability exists in Delta Electronics WPLSoft version 2.51, which originates from the transmission of sensitive information in clear...
PT-2023-5873 · Libcue +6 · Libcue +6
Name of the Vulnerable Software and Affected Versions: libcue versions 2.2.1 and prior Description: The issue is related to out-of-bounds array access in libcue, which provides an API for parsing and extracting data from CUE sheets. A user of the GNOME desktop environment can be exploited by...
DEBIAN-CVE-2023-43615
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow...
CVE-2023-28791
Cross-Site Request Forgery CSRF vulnerability in Gangesh Matta Simple Org Chart plugin = 2.3.4 versions...
CVE-2023-27448
Cross-Site Request Forgery CSRF vulnerability in MakeStories Team MakeStories for Google Web Stories plugin = 2.8.0 versions...
The vulnerability in the function for protecting group IP traffic in the GET VPN implementation, based on the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols, allows a attacker to execute arbitrary code, cause service failures, or gain full control over the application.
The vulnerability in the function for protecting group IP traffic in the GET VPN implementation of the Group Domain of Interpretation GDOI and G-IKEv2 protocols on Cisco IOS and IOS XE operating systems stems from the operation of operations beyond the buffer in memory when processing protocol...
PJSIP Resource Management Error Vulnerability
PJSIP is a free and open source multimedia communications library written in C that implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. A resource management error vulnerability exists in versions of PJSIP prior to 2.14, which stems from a higher-level transfer being...
CVE-2023-3701
Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files o...
CVE-2023-5357 Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
