CVE-2024-54143

CVE-2024-54143 affects OpenWrt ASU (image-on-demand server). The build request hash truncates SHA-256 to 12 characters, lowering entropy and enabling potential hash collisions. An attacker could poison the artifact cache by serving a previously built malicious image, possibly combined with a comm...

CVE-2024-54143 openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious...

Cache Poisoning

moodle/moodle is vulnerable to Cache Poisoning. The vulnerability is due to improper validation mechanisms in local storage, allowing attackers to manipulate cached data maliciously...

GHSA-H924-8G65-J9WG Traefik's X-Forwarded-Prefix Header still allows for Open Redirect

Impact There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. Patches - https://github.com/traefik/traefik/releases/tag/v2.11.14 - https://github.com/traefik/traefik/releases/tag/v3.2.1 Workarounds No workaround. For more...

PT-2024-35090

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.14 Traefik versions prior to 3.2.1 Description There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue can be exploited to bypass...

Mozilla: Denial of Access to Static Resources via Cache Poisoning on addons.allizom.org

A cache poisoning vulnerability was identified on addons.allizom.org that allowed an attacker to block access to static resources such as images and JavaScript files. The issue was exploited by processing the X-HTTP-Method-Override header, which was honored by the origin server and treated the...

Cache Poisoning

libcurl.so is vulnerable to Cache Poisoning. The vulnerability is due to improper handling of HSTS cache entries in curl, where a subdomain’s HSTS expiry time can overwrite the parent domain's cache entry, causing incorrect HTTPS timeout handling. It allows an attacker to trigger insecure HTTP...

CVE-2024-38479 Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue...

CVE-2024-38479 Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue...

CVE-2024-38479

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue...

Reliance On Untrusted Inputs In A Security Decision

Sinatra is vulnerable to Reliance on Untrusted Inputs in a Security Decision. The vulnerability is due to improper handling of the X-Forwarded-Host header via the X-Forwarded-Host header, allowing attackers to exploit Open Redirect Attacks, Cache Poisoning, or Routing-based SSRF through untrusted...

PT-2024-9209 · Apache +1 · Apache Traffic Server +1

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.5 Description: The issue is related to improper input validation, which can allow a remote attacker to implement a cache poisoning attack. Th...

Moodle vulnerable to cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

GHSA-2R9M-WG35-RFVC Moodle vulnerable to cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

CVE-2024-43428

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

UBUNTU-CVE-2024-43428

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

CVE-2024-43428

CVE-2024-43428 corresponds to Moodle cache poisoning via injection into storage. The available connected documents indicate the underlying issue is insufficient validation for local storage, enabling a local attacker to poison the cache. Affected context is Moodle (various official advisories ref...

CVE-2024-43428 Moodle: cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

CVE-2024-43428 Moodle: cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required...

CVE-2024-43428 Moodle: cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required...