CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: step, up, buildkitd, pulumi, secrets-store-csi-driver-provider-azure, airflow, wal-g, falcoctl, cosign, velero, tkn, fulcio, rclone, k8sgpt, flyte, trivy, zarf, argo-events, druid, opentelemetry-collector, restic, spire-server, grafana-agent-operator,...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: spicedb, opentelemetry-collector-contrib, opentelemetry-collector...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-635)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-635 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Tenable has extracted the preceding description block directly from the tested product security advisory. No...

Denial Of Service (DoS)

rack-contrib is vulnerable to a Denial Of Service DoS. The vulnerability is due to the user-controlled profilerruns parameter not being constrained, which allows an attacker to allocate resources on the server side without limitation, resulting in Denial of Service...

Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider...

Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

The Migrate queue importer module enables you to create cron migrationsconfiguration entities with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the unconstrained value of the incoming profilerruns parameter. An attacker can cause the server to allocate excessive resources, leading to a denial of service by sending...

CVE-2024-35231

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...

CVE-2024-35231

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...

UBUNTU-CVE-2024-35231

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...

CVE-2024-35231 rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...

CVE-2024-35231

rack-contrib before 2.5.0 is vulnerable to denial of service because the profiler_runs parameter was not constrained, enabling unbounded resource consumption on the server. A patch exists in version 2.5.0. Remediation: upgrade to rack-contrib 2.5.0 or newer. Exploitation details and PoC are descr...

CVE-2024-35231 rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...

PT-2024-26396 · Unknown · Rack-Contrib

Name of the Vulnerable Software and Affected Versions: rack-contrib versions prior to 2.5.0 Description: The issue is related to a denial of service vulnerability due to the lack of constraints on user-controlled data profiler runs. This allows for the allocation of resources on the server side...

Denial of Service in rack-contrib via "profiler_runs" parameter

rack-contrib prior to version 2.5.0 is vulnerable to a Denial of Service via the profilerruns HTTP request parameter. Versions Affected: = 2.5.0 Impact An attacker can trigger a Denial of Service by sending an HTTP request with an overly large profilerruns parameter. shell curl...

CVE-2024-35231

creationtimestamp| type| source ---|---|--- 2024-05-24 23:03:00+00:00| published-proof-of-concept| https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869...

Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form. The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is...

Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers...

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

This module exposes Drupal resources e.g. entities as RESTful web services. The module doesn't sufficiently restrict access for user resources...

RHEL 8 : opentelemetry-go-contrib (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2023-47108 Note that...