CVE-2024-28101: Improper Handling of Highly Compressed Data (Data Amplification)

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

PT-2024-22266

Name of the Vulnerable Software and Affected Versions Apollo Router versions 0.9.5 through 1.40.2 Description The Apollo Router is subject to a Denial-of-Service DoS type issue. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http max request bytes...

CVE-2023-45290 Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...

CVE-2023-45290 Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...

CVE-2023-45290

When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...

Uncontrolled Resource Consumption

Mattermost is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the failure in limiting the number of role names that can be requested from the API. An attacker can cause the server to run out of memory and crash by issuing an unusually large HTTP request...

CVE-2023-25926: Improper Restriction of XML External Entity Reference

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599...

Fedora 39 : gifsicle (2024-5e50570506)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e50570506 advisory. Update to 1.95 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

CentOS 9 : podman-4.1.1-3.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the podman-4.1.1-3.el9 build changelog. - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via...

Denial Of Service(DoS)

suricata is vulnerable to Denial Of ServiceDoS . The vulnerability is due to consume excessive CPU and memory resources when processing crafted network traffic which could allow an attacker to craft traffic in a way that causes Suricata to consume excessive CPU and memory, leading to extreme...

Ubuntu 20.04 LTS / 22.04 LTS : GNU binutils vulnerabilities (USN-6655-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6655-1 advisory. It was discovered that GNU binutils was not properly handling the logic behind certain memory management related operations, which could lead...

Debian dla-3737 : imagemagick - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3737 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3737-1 [email protected]...

SUSE-SU-2024:0574-1 Security update for bind

This update for bind fixes the following issues: Update to release 9.16.48: - CVE-2023-50387: Fixed a denial-of-service caused by DNS messages containing a lot of DNSSEC signatures bsc1219823. - CVE-2023-50868: Fixed a denial-of-service caused by NSEC3 closest encloser proof bsc1219826. -...

CVE-2023-6516

A flaw was found in the named application, part of the bind9 package, which uses a cache database to speeds up DNS queries. To maintain its efficiency when running as a recursive name resolver, named performs a cache database clean up under certain conditions. This issue may allow an attacker to...

EulerOS 2.0 SP5 : gdb (EulerOS-SA-2024-1137)

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn...

EulerOS 2.0 SP5 : binutils (EulerOS-SA-2024-1133)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A memory consumption issue in getdata function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafte...

Liferay Portal denial of service (memory consumption)

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...

GHSA-87M3-6QJ3-P3XH Liferay Portal denial of service (memory consumption)

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...

CVE-2024-25143

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...

CVE-2024-25143

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...