log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map MDC input data can craft malicious input data that contains a recursive lookup and can cause Denial of...

log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map MDC input data can craft malicious input data that contains a recursive lookup and can cause Denial of...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Mozilla: iframe contents could be rendered outside the border

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

Adobe InDesign Zero Pointer DoS

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the handling of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

@podium/layout (>=4.0.0-next, <=5.0.0-next.1), @podium/podlet (>=4.0.0-nest.2, <=5.0.0-next.1) +1 more potentially affected by CVE-2022-24822 via @podium/proxy (>=4.0.0-next.1, <=4.2.73)

@podium/proxy NPM version =4.0.0-next.1, =4.0.0-next, =4.0.0-nest.2, =1.0.0, =2.4.1 Source cves: CVE-2022-24822 Source advisory: GHSA-3HJG-VC7R-RCRW...

GHSA-3HJG-VC7R-RCRW Denial of Service vulnerability in @podium/layout and @podium/proxy

Impact An attacker using the Trailer header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. Patches @podium/layout which is the main way developers/users are vulnerable to this...

@podium/layout (>=4.0.0-next, <=5.0.0-next.1), @podium/podlet (>=4.0.0-nest.2, <=5.0.0-next.1) +1 more potentially affected by CVE-2022-24822 via @podium/proxy (>=4.0.0-next.1, <=4.2.73)

@podium/proxy NPM version =4.0.0-next.1, =4.0.0-next, =4.0.0-nest.2, =1.0.0, =2.4.1 Source cves: CVE-2022-24822 Source advisory: OSV:GHSA-3HJG-VC7R-RCRW...

Design/Logic Flaw

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

@podium/layout (>=2.5.1, <=5.0.0-next.1), @podium/podlet (>=3.0.0-beta.1, <=5.0.0-next.1) +1 more potentially affected by CVE-2022-24822 via @podium/proxy (>=2.4.4, <=4.2.73)

@podium/proxy NPM version =2.4.4, =2.5.1, =3.0.0-beta.1, =1.0.0, =2.4.1 Source cves: CVE-2022-24822 Source advisory: MEND:CVE-2022-24822...

CVE-2022-24822

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

CVE-2022-28286

The Mozilla Foundation Security Advisory describes this flaw as: Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks...

CVE-2022-24822: Uncaught Exception

Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74,...

PT-2022-16902

Name of the Vulnerable Software and Affected Versions @podium/layout versions prior to 4.6.110 @podium/proxy versions prior to 4.2.74 Description The issue allows an attacker to take down the server by using the Trailer header as part of the request against proxy endpoints. All Podium layouts tha...

Finn.no Podium security vulnerability

Finn.no Podium is a library for building micro front ends from Finn.no Norway. A security vulnerability in Finn.no Podium layout prior to 4.6.110 and Podium proxy prior to 4.2.74 allows an attacker to shut down a server using the Trailer header as part of a request to the proxy endpoint...

CVE-2022-28286

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird 91.8, Firefox 99, and Firefox ESR 91.8...