cfnts 缓冲区错误漏洞

Cloudflare cfnts is Cloudflare's implementation of the NTS protocol written in Rust. A security vulnerability exists in versions prior to cfnts 783490b, which stems from an unchecked read in the NTP server that allows a remote attacker to trigger a panic by sending an NTSAuthenticator packet with...

PT-2023-22652 · Cloudflare · Cfnts

Name of the Vulnerable Software and Affected Versions: github.com/cloudflare/cfnts versions prior to commit 783490b Description: The issue is related to an unchecked read in the NTP server, which allows a remote attacker to trigger a panic by sending an NTSAuthenticator packet with an extension...

CVE-2023-3036: Improper Restriction of Operations within the Bounds of a Memory Buffer

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packe...

Hacks Against Ukraine's Emergency Response Services Rise During Bombings

Data from Cloudflare's free digital defense service, Project Galileo, illuminates new links between online and offline attacks...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP that stems from a misconfiguration that makes it susceptible to clickjacking attacks...

GO-2023-1765 Leaked shared secret and weak blinding in github.com/cloudflare/circl

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

GHSA-8VX6-69VG-C46F Buffer under-read in workerd

Impact Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead...

Buffer under-read in workerd

Impact Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead...

CVE-2023-2512 Buffer under-read in workerd

Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a...

CVE-2023-2512 Buffer under-read in workerd

Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a...

CVE-2023-2512

CVE-2023-2512 affects Cloudflare workerd’s FormData API implementation prior to v1.20230419.0, where an integer overflow could occur if a FormData contains more than 2^31 elements. The forEach() iteration could read from the wrong memory location, potentially causing a segmentation fault and, in ...

Insecure Randomness

github.com/cloudflare/circl is vulnerable to Insecure Randomness. Kyber and FrodoKEM did not check whether crypto/rand.Read returned an error, leading to a predictable shared secret. The tkn20 and blindrsa components did not check if enough randomness was returned from the user provided randomnes...

Cloudflare Public Bug Bounty: Privilege escalation to root in Pages build image v2

Vulnerability description not provided...

CSRF bypass

Description URL parsing with Qwik uses the new URLa, b constructor. A little-known fact about this constructor is that if an attacker controls a they have complete control of the finally resolved URL. For example: const url = new URLattackervalue, "http://localhost" By entering //test.com, we can...

Cloudflare Public Bug Bounty: Cloudflare CASB Confused Deputy Problem

A vulnerability was found in Cloudflare CASB on Microsoft and GitHub integrations, allowing an attacker to create a new integration and access sensitive information if they were able to enumerate a valid tenant UUID or domain. The issue was resolved by disallowing the creation of multiple...

Cloudflare Public Bug Bounty: Plaintext leakage of DNS requests in Windows 1.1.1.1 WARP client

A vulnerability in the Windows 1.1.1.1 WARP client allowed for plaintext leakage of DNS requests. When connected to WARP over an IPv6-capable network, the client assigned Unique Local Addresses instead of loopback IPv6 addresses. This could potentially expose DNS queries to unknown devices on the...

CVE-2023-0652

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652

CVE-2023-0652 is a Local Privilege Escalation in Cloudflare WARP Installer (Windows). The issue stems from a hardlink created in the ProgramData folder during the repair process, where the MSI-based installer could forge the hardlink’s destination, enabling privilege escalation and overwriting SY...