varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

PT-2024-23561 · Unknown · Ros2 Iron Irwini

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: An issue was discovered in the default configurations of ROS2 Iron Irwini, allowing unauthenticated attackers to authenticate using default credentials. Recommendations: For ROS2 Iron Irwini version 2,...

PT-2024-23558 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: The issue allows a malicious user to escalate privileges by injecting malicious ROS2 nodes into the system remotely. Recommendations: For ROS2 Iron Irwini version 2, at the moment, there is no...

PT-2024-23568 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: An insecure deserialization issue allows attackers to execute arbitrary code via a crafted input to the Data Serialization and Deserialization Components,...

PT-2024-23557 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: The issue allows remote attackers to gain control of multiple ROS2 nodes, potentially compromising system integrity, executing arbitrary commands, and disclosing sensitive information. Recommendations:...

PT-2024-23572 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: A issue was discovered that allows remote attackers to cause a denial of service DoS in the ROS2 nodes. Recommendations: For ROS2 Galactic Geochelone versio...

PT-2024-18209 · WordPress · Responsive Gallery Grid

Name of the Vulnerable Software and Affected Versions: Responsive Gallery Grid WordPress plugin versions prior to 2.3.11 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

WordPress Plugin WPB Show Core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. The WordPress Plugin WPB Sh...

The vulnerability of the amphp/http library and the amphp/http-client HTTP client allows a attacker to induce a service failure.

The vulnerability of the amphp/http library and the amphp/http-client HTTP client in terms of implementing the HTTP/2 protocol is related to uncontrolled memory allocation due to improper restrictions on the size of field blocks during the processing of CONTINUATION frames. Exploiting this...

PT-2024-23590 · Unknown · Ros2 Dashing Diademata

Name of the Vulnerable Software and Affected Versions: ROS2 Dashing Diademata versions 2 Description: A command injection issue has been found, allowing remote attackers to execute arbitrary commands. Recommendations: For ROS2 Dashing Diademata version 2, update to a version that includes a fix f...

PT-2024-23591 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Dashing Diademata versions 2 Description: A buffer overflow issue has been found in the C++ components, potentially allowing attackers to execute arbitrary code. Recommendations: For ROS2 Dashing Diademata version 2, at the moment, there...

PT-2024-23589 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 versions 2 Description: A shell injection issue was discovered, allowing remote attackers to potentially exploit the system. Recommendations: For ROS2 version 2, at the moment, there is no information about a new...

AZL-39232 CVE-2023-45288 affecting package kata-containers for versions less than 3.2.0.azl2-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39229 CVE-2023-45288 affecting package moby-engine for versions less than 24.0.9-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39445 CVE-2023-45288 affecting package kured for versions less than 1.14.2-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38431 CVE-2023-45288 affecting package telegraf for versions less than 1.31.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

Apaczka 安全漏洞

Apaczka is a solution for managing a company's transportation process from Apaczka. A security vulnerability exists in Apaczka versions v1 through v4 that stems from allowing information to be collected from saved templates without authentication...

InstantCMS 安全漏洞

InstantCMS is a free open source CMS from instantSoft open source. A security vulnerability exists in InstantCMS version v2.16.2, which stems from a SQL injection vulnerability in indexchartdata...

Tempesta 安全漏洞

Tempesta FW is an all-in-one open source solution open-sourced by Tempesta Technologies. for high-performance web content delivery and advanced protection against DDoS and network attacks. A security vulnerability exists in Tempesta versions prior to 0.7.1, which stems from a flood of HTTP/2...