CVE-2023-27314

The CVE-2023-27314 issue affects NetApp ONTAP 9.x: versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are vulnerable to a remote, unauthenticated attacker that can cause the HTTP service to crash. Root cause details are described in the related PT-2023-21062 advisory and...

CVE-2023-27314 Denial of Service Vulnerability in ONTAP 9

ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service...

CVE-2023-27314 Denial of Service Vulnerability in ONTAP 9

ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service...

CVE-2023-27314: Uncontrolled Resource Consumption

ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service...

PT-2023-21062 · Netapp · Ontap

Name of the Vulnerable Software and Affected Versions: ONTAP 9 versions prior to 9.8P19 ONTAP 9 versions prior to 9.9.1P16 ONTAP 9 versions prior to 9.10.1P12 ONTAP 9 versions prior to 9.11.1P8 ONTAP 9 versions prior to 9.12.1P2 ONTAP 9 versions prior to 9.13.1 Description: The issue allows a...

Presto JDBC Server-Side Request Forgery by nextUri

Summary Presto JDBC is vulnerable to Server-Side Request Forgery SSRF when connecting a remote Presto server. An attacker can modify the nextUri parameter to internal server in response content that Presto JDBC client will request next and view sensitive information from highly sensitive internal...

PT-2023-8218 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TC...

PT-2023-8213 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: The issue is related to a stack-based buffer overflow in the httpd API-AUTH Digest function of the D-Link G416 router's HTTP microprogram. This can be exploited by a remote attacker to...

PT-2023-8228 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TC...

PT-2023-8032 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: The issue exists due to the lack of proper validation of a user-supplied string before using it to execute a system call in the HTTP service listening on TCP port 80. This allows...

mongoose:fuzz_netdriver_http: Stack-buffer-overflow in mg_http_serve_dir

Detailed Report: https://oss-fuzz.com/testcase?key=5217433154355200 Project: mongoose Fuzzing Engine: honggfuzz Fuzz Target: fuzznetdriverhttp Job Type: honggfuzzasanmongoose Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fffe35b98ff Crash State: mghttpservedir fn...

PT-2023-7950

Name of the Vulnerable Software and Affected Versions D-Link G416 affected versions not specified Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. The specific flaw exists within the HTTP service listenin...

PT-2023-8147 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: The issue is related to a command injection vulnerability in the HTTP service of D-Link G416 routers, which allows network-adjacent attackers to execute arbitrary code on affected...

PT-2023-8214 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: The issue is related to a stack-based buffer overflow in the httpd API-AUTH Timestamp Processing function of the D-Link G416 router's HTTP microprogram. This can be exploited by a remot...

PT-2023-6702 · Tp Link · Tp-Link Tapo C100

Name of the Vulnerable Software and Affected Versions: TP-Link Tapo C100 versions 1.1.15 Build 211130 Rel.15378n4555 and before Description: The issue is related to the HTTP service of the TP-Link Tapo C100 IP camera's firmware, specifically with the handling of CRLF sequences in HTTP headers. Th...

GHSA-3QJ8-93XH-PWH2 Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references. Original Description There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated a...

CVE-2023-30798

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...

CVE-2023-30798

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...

Design/Logic Flaw

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...

PYSEC-2023-48

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...