CVE-2023-26044 ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impa...

FreeBSD : zeek -- potential DoS vulnerabilities (96d6809a-81df-46d4-87ed-2f78c79f06b1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 96d6809a-81df-46d4-87ed-2f78c79f06b1 advisory. - Tim Wojtulewicz of Corelight reports: Receiving DNS responses from async DNS requests via A...

FreeBSD : zeek -- potential DoS vulnerabilities (7a425536-74f7-4ce4-9768-0079a9d44d11)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7a425536-74f7-4ce4-9768-0079a9d44d11 advisory. - Tim Wojtulewicz of Corelight reports: Receiving DNS responses from async DNS requests via the...

8x8 Bounty: connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=

The server of connect.8x8.com was vulnerable to excessive resource consumption due to incorrect date range control via the /api/v1/reports endpoint. Attackers could cause the server to crash by repeatedly increasing the date range, potentially leading to a DoS attack. The vulnerability has since...

FreeBSD : zeek -- potential DoS vulnerabilities (2b5fc9c4-eaca-46e0-83d0-9b10c51c4b1b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2b5fc9c4-eaca-46e0-83d0-9b10c51c4b1b advisory. - Tim Wojtulewicz of Corelight reports: A missing field in the SMB FSControl script-land record could...

logrotate security update

3.18.0-7 - lockState: do not print error: when exit code is unaffected 2090926 3.18.0-6 - fix potential DoS from unprivileged users via the state file CVE-2022-1348 Mon Aug 09 2021 Mohan Boddu - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 3.18.0-4 - make renamecopy and...

ALSA-2022:8393 Moderate: logrotate security update

The logrotate utility simplifies the administration of multiple log files by allowing their automatic rotation, compression, removal, and mailing. Security Fixes: logrotate: potential DoS from unprivileged users via the state file CVE-2022-1348 For more details about the security issues, includin...

FreeBSD : zeek -- potential DoS vulnerabilities (60d4d31a-a573-41bd-8c1e-5af7513c1ee9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 60d4d31a-a573-41bd-8c1e-5af7513c1ee9 advisory. - Tim Wojtulewicz of Corelight reports: Fix an issue where a specially-crafted FTP packet can cause Zee...

FreeBSD : zeek -- potential DoS vulnerabilities (3110b29e-c82d-4287-9f6c-db82bb883b1e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3110b29e-c82d-4287-9f6c-db82bb883b1e advisory. - Tim Wojtulewicz of Corelight reports: Fix a possible overflow and crash in the ARP analyzer when...

Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple

Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

MGASA-2021-0511 Updated python-django-filter packages fix security vulnerability

In django-filter before version 2.4.0, automatically generated 'NumberFilter' instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents...

JetBrains Security Bulletin Q3 2021

JetBrains Security JetBrains Security Bulletin Q3 2021 Robert Demmer In the third quarter of 2021, we resolved a number of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved. Product | Description | Severity ...

Denial of service

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage...

Excessive memory usage in tokio-rustls

tokio-rustls does not call processnewpackets immediately after read, so the expected termination condition wantsread always returns true. As long as new incoming data arrives faster than it is processed and the reader does not return pending, data will be buffered. This may cause DoS...

CVE-2021-32823 Potential Denial-of-Service in bindata

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit. In combination with...

SUSE: Security Advisory (SUSE-SU-2020:1523-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-26411

A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x =13.4 to =13.5 to =13.6 to 13.6.2. Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused...

CVE-2020-26411

A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x =13.4 to =13.5 to =13.6 to 13.6.2. Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused...

Fedora 31 : golang-vitess / hugo (2020-bd764dd275)

"Rebuilt to fix GHSA-jf24-p9p9-4rjh Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory FEDORA-2020-bd764dd275. include"compat.inc"; if description scriptid134140; scriptversion"1.1"; scriptcvsdate"Date: 2020/02/28";...

Fedora 30 : caddy / etcd / hugo (2020-279c61dd70)

"Rebuilt to fix GHSA-jf24-p9p9-4rjh Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory FEDORA-2020-279c61dd70. include"compat.inc"; if description scriptid134130; scriptversion"1.1"; scriptcvsdate"Date: 2020/02/28";...