Cloudflare Public Bug Bounty: Enable 2Fa verification without verifying email

It was possible to enable Two-factor authentication feature for an unverified Cloudflare account . As a consequence, a legitimate owner of the e-mail address, which was used to create the unverified account, is unable to log in or reset password to the Cloudflare account. The issue was fixed by t...

Cloudflare Public Bug Bounty: Basic XSS [WAF Bypasses]

Vulnerability description not provided...

Cloudflare WARP 后置链接漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare Inc. in the United States. A backlink vulnerability exists in Cloudflare WARP client for Windows versions prior to 2022.5.309.0, which stems from a vulnerability that allows the creation of a mount point...

GHSA-3JHM-87M6-X959 Path traversal mitigation bypass in OctoRPKI

Impact The existing URI path filters in OctoRPKI version 1.4.3 mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder. Specific Go Packages Affected...

Path traversal mitigation bypass in OctoRPKI

Impact The existing URI path filters in OctoRPKI version 1.4.3 mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder. Specific Go Packages Affected...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

Design/Logic Flaw

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

CVE-2022-2147

CVE-2022-2147 affects Cloudflare Warp for Windows (versions 2022.2.95.0 and earlier); it is caused by an unquoted service path, enabling arbitrary code execution with privilege escalation via a local attack. The fix is in version 2022.3.186.0. Exploitation status is not provided in the documents....

CVE-2022-2147 Unquoted Service Path in Cloudflare WARP for Windows

Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0...

Malicious Package

Overview launchdarkly-cloudflare-worker-template is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Cloudflare Warp 代码问题漏洞

Cloudflare Warp Cloudflare Vpn is a client application for secure connections from the American company Cloudflare. A security vulnerability exists in Cloudflare Warp for Windows version 2022.2.95.0. An attacker could exploit the vulnerability to execute arbitrary code leading to elevation of...

Malicious code in eurid_cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 221d668aadab8ae1b1b3645fce4b4034d75dafda20957f51745af327ace0617e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in matomo-analytics-cloudflare-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379cfcf198b8b35c36cafb16790478cac75d84f6f4c52217add6893135f41d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4496 Malicious code in matomo-analytics-cloudflare-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379cfcf198b8b35c36cafb16790478cac75d84f6f4c52217add6893135f41d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloudflare-docs-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab02f1a2c82a631dc786a2035d2e1d3f21075780099412aa34aa7349de70557 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloudflare-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 908520a9518631f583d13833775c371f01544eaacb80c3d2879f9491fb0547eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1934 Malicious code in cloudflare-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 908520a9518631f583d13833775c371f01544eaacb80c3d2879f9491fb0547eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4261 Malicious code in launchdarkly-cloudflare-worker-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de576cf63a8f34f8fc17ce760973d6f5164d2bd3ddac3fe040cd53568d5ca332 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...