1705 matches found
CVE-2023-50463
The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...
CVE-2023-50463
The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...
golang: cmd/go: line directives allows arbitrary execution during build
A flaw was found in the golang cmd/go standard library. A line directive "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to pass during compilation. This can result in the unexpected execution of arbitrary code when running "go...
What is NIS2, and how can you best prepare for the new cybersecurity requirements in the EU?
NIS2 is a European directive that includes new measures to ensure that organizations operating in the European Union EU have a high common level of network and infrastructure security. The "directive" outlines the goals all EU member states must achieve. However, each country will implement it in...
ROS-20231109-01
Go programming language vulnerability is related to insecure external control of critical state data state when processing the setuid and setgid attributes. Exploitation of the vulnerability could allow an attacker, acting remotely, escalate their privileges and gain access to read, modify, or...
YouTube's Ad Blocker Detection Believed to Break EU Privacy Law
A complaint filed with the EU’s independent data regulator accuses YouTube of failing to get explicit user permission for its ad blocker detection system, potentially violating the ePrivacy Directive...
BIT-NGINX-INGRESS-CONTROLLER-2022-41743
NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttphlsmodule that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when...
The vulnerability of the “//line” directive in the Go programming language allows a violator to execute arbitrary code.
The vulnerability of the “//line” directive in the Go programming language is related to errors in data processing during syntax analysis of code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Ingress-nginx path sanitization can be bypassed
Ingress-nginx path sanitization can be bypassed with logformat directive...
GHSA-GVRM-W2F9-F77Q Ingress-nginx path sanitization can be bypassed
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2022-4886
Ingress-nginx path sanitization can be bypassed with logformat directive...
Code injection
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
Ingress-nginx path sanitization can be bypassed with logformat directive...
PT-2023-6604 · Unknown · Ingress-Nginx
Name of the Vulnerable Software and Affected Versions: ingress-nginx affected versions not specified Description: The issue is related to a controller vulnerability in the Kubernetes ingress-nginx cluster, which is associated with errors in processing input data. This can allow a remote attacker ...
BIT-2023-44388
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...
The hot topics from Europe’s largest trade fair for IT security
IT-SA Expo & Congress claims to be Europes largest trade fair for IT security. And it really covers a wide range of security and security-related products and services. The event takes place in Nuremberg, Germany and provides an opportunity for vendors to show themselves to the public, create new...
CVE-2023-44388
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...
Design/Logic Flaw
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...
CVE-2023-44388 Malicious requests can fill up the log files resulting in a deinal of service in Discourse
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...