GHSA-VRW8-FXC6-2R93 vulnerabilities

Vulnerabilities for packages: step-issuer, sftpgo, step-issuer-fips, tkn-fips, rclone, karma, caddy-fips, gitness, buf, dapr-fips, dapr, gogatekeeper, step-ca-fips, tkn, telegraf, cloudflared, kyverno-policy-reporter-ui, caddy, rclone-fips, step-fips, step, kyverno-policy-reporter-ui-fips, step-c...

CVE-2024-35223

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

GO-2022-1033 Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard

Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard...

GO-2023-1955 Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr

Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr...

GO-2024-2879 Dapr API Token Exposure in github.com/dapr/dapr

Dapr API Token Exposure in github.com/dapr/dapr...

CVE-2024-35223

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223

CVE-2024-35223 affects Dapr where, when acting as a gRPC proxy for remote service invocation, the proxy may leak the invoker app’s token to the invoked app due to incorrect token handling. The root cause is that the proxy forwards the invoker’s app token (APP_API_TOKEN) instead of the invoked app...

Dapr 信息泄露漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. A security vulnerability exists in Dapr that stems from the disclosure of application tokens when using Dapr as a gRPC proxy for remote service calls. Affected products and versions:Dapr version 1.13.0, 1.13.1, 1.13.2...

GHSA-284C-X8M7-9W5H Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

PT-2024-26387 · Dapr · Dapr

Name of the Vulnerable Software and Affected Versions: Dapr versions prior to 1.13.3 Description: Dapr sends the app token of the invoker app instead of the app token of the invoked app when using Dapr as a gRPC proxy for remote service invocation, causing a leak of the application token of the...

The vulnerability in the Dapr Dashboard’s web interface relates to the lack of authentication for critical functions, allowing attackers to influence the confidentiality of protected information.

The vulnerability in the Dapr Dashboard’s web interface is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to influence the confidentiality of the protected information...

Authentication Bypass

github.com/dapr/dapr is vulnerable to Authentication Bypass. The library allows bypassing of API token authentication, which enables an attacker to send unauthorized HTTP requests via the Dapr sidecar, only impacting users who rely on this authentication method...

CVE-2023-37918

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

Design/Logic Flaw

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

Dapr API token authentication bypass in HTTP endpoints

Summary A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10....

GHSA-59M6-82QM-VQGJ Dapr API token authentication bypass in HTTP endpoints

Summary A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10....