CVE-2024-25734

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts...

CVE-2024-25734

The WyreStorm Apollo VX20 conferencing video device is vulnerable to account enumeration in versions prior to 1.3.58 . The root cause is the TELNET service prompting for a password only after a valid username is provided. This behavior allows remote attackers to identify valid user accounts, pote...

CVE-2024-25736

WyreStorm Apollo VX20 devices running firmware versions prior to 1.3.58 are vulnerable to an improper access control issue. A remote attacker can trigger a device restart by sending an unauthenticated HTTP GET request to the /device/reboot endpoint. This vulnerability can lead to a Denial of Serv...

CVE-2024-25734

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts...

PT-2024-21118 · Wyrestorm · Wyrestorm Apollo Vx20

Name of the Vulnerable Software and Affected Versions: WyreStorm Apollo VX20 versions prior to 1.3.58 Description: An issue allows remote attackers to restart the device via a "/device/reboot" GET request. Recommendations: For versions prior to 1.3.58, update to version 1.3.58 or later to resolve...

PT-2024-21117 · Wyrestorm · Wyrestorm Apollo Vx20

Name of the Vulnerable Software and Affected Versions: WyreStorm Apollo VX20 versions prior to 1.3.58 Description: An issue was discovered where the TELNET service prompts for a password only after a valid username is entered. This might make it easier for remote attackers to enumerate user...

CVE-2024-28101

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

Apollo Router 安全漏洞

Apollo Router is a configurable, high-performance graphical router written in Rust. A security vulnerability exists in Apollo Router versions 0.9.5 through 1.40.2 that stems from a compressed payload that does not adhere to HTTP payload restrictions, resulting in a denial of service...

Design/Logic Flaw

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

HPESBHF04623 rev.1 - HPE Apollo/XL Servers Using Intel Server Platform Services (SPS) Firmware, INTEL-SA-00923, 2024.1 IPU - Intel Chipset Software and SPS Advisory, Remote Denial of Service Vulnerability

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL220n Gen10 Plus Server - Prior to v04.04.04.603.0 HPE Apollo 2000 Gen10 Plus System - Prior to v04.04.04.603.0 HPE ProLiant XL290n Gen10 Plus Server - Prior to...

HPESBHF04613 rev.1 - Certain HPE Apollo/XL Servers Using Certain Intel Processors, INTEL-SA-00960, 2024.1 IPU - Intel Xeon Processor Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 2000 Gen10 Plus System - Prior to v2.0002-22-2024 HPE ProLiant XL220n Gen10 Plus Server - Prior to v2.0002-22-2024 HPE ProLiant XL290n Gen10 Plus Server - Prior to...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

CVE-2024-28101

CVE-2024-28101 concerns the Apollo Router (Rust) and affects versions 0.9.5 through 1.40.2. The vulnerability arises when handling compressed HTTP payloads: after decompression, the router evaluates limits.http_max_request_bytes, which can lead to significant memory consumption if highly compress...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

GHSA-CGQF-3CQ5-WVCJ Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

inigo-rs (>=0.1.1, <=0.1.4) potentially affected by CVE-2024-28101 via apollo-router (1.6.0)

apollo-router CARGO version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-router and may be impacted: - inigo-rs =0.1.1, =0.1.4 Source cves: CVE-2024-28101 Source advisory: OSV:GHSA-CGQF-3CQ5-WVCJ...

CVE-2024-28101: Improper Handling of Highly Compressed Data (Data Amplification)

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

PT-2024-22266

Name of the Vulnerable Software and Affected Versions Apollo Router versions 0.9.5 through 1.40.2 Description The Apollo Router is subject to a Denial-of-Service DoS type issue. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http max request bytes...