Denial of Service (DoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

CVE-2023-6132

creationtimestamp| type| source ---|---|--- 2024-02-24 10:41:42+00:00| seen| https://t.me/ctinow/192525 2024-02-29 19:31:27+00:00| seen| https://t.me/ctinow/196935 2024-02-29 19:31:34+00:00| seen| https://t.me/ctinow/196941...

SUSE CVE-2024-26141

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

PT-2024-13075 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.1.7 through 12.0.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

@adamlonsdale/backstage-plugin-armorcode-backend (>=0.0.1-alpha, <=0.0.4), @austin-garrard/backstage-plugin-backend (>=0.0.1-alpha.22, <=0.0.1) +194 more potentially affected by CVE-2024-26150 via @backstage/backend-common (>=0.0.0-nightly-20220708025041, <=0.17.0)

@backstage/backend-common NPM version =0.0.0-nightly-20220708025041, =0.0.1-alpha, =0.0.1-alpha.22, =0.0.1-alpha.18, =0.1.0, =0.0.0-nightly-20220709024234, =0.0.0-nightly-20220811024336, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20220709024234, =0.0.0-nightly-2021101322257,...

CVE-2024-26141

A denial of service DoS vulnerability was found in rubygem-rack in how it parses Range Header. Carefully crafted range headers can cause a server to respond with an unexpectedly large response. Responding with large responses could lead to a denial of service issue. Mitigation No mitigation is...

Dell Secure Connect Gateway Application SQL Injection Vulnerability

The Dell Secure Connect Gateway Application is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway Application suffers from a SQL injection vulnerability that can be exploited by an attacker to inject malicious content into the filters of the IP range Rest API, resulting...

Possible DoS Vulnerability with Range Header in Rack

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact Carefully crafted Range headers can cause a server to...

PT-2024-10354 · Drupal · Node Access Rebuild Progressive

Name of the Vulnerable Software and Affected Versions: Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication. Description: The issue is related to improper...

CVE-2024-21682

This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 all versions. Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or...

Decidim security breach

Decidim is a participatory democracy framework written in Ruby on Rails. A security vulnerability exists in Decidim versions 0.23.0 through 0.27.4, which stems from a possible cross-site request forgery attack in the questionnaire templates preview...

PT-2024-2154 · Atlassian · Jira Service Management Server +1

Name of the Vulnerable Software and Affected Versions: Assets Discovery versions 1.0 through 6.2.0 Description: This issue allows an authenticated attacker to modify system calls, potentially impacting confidentiality, integrity, and availability. It requires no user interaction. Assets Discovery...

CVE-2024-1633

During the secure boot, bl2 the second stage of the bootloader loops over images defined in the table “bl2memparamsdescs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integ...

Integer overflow

During the secure boot, bl2 the second stage of the bootloader loops over images defined in the table “bl2memparamsdescs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integ...

CVE-2024-1633

CVE-2024-1633 is a bootloader issue in bl2 where reading image length/destination from each image certificate uses a 32-bit unsigned value, causing an integer overflow. This can bypass memory range checks and write data outside buffers, potentially bypassing secure boot. Affected component: bl2 (...

CVE-2024-1633 FIP Header Integer Overflow

During the secure boot, bl2 the second stage of the bootloader loops over images defined in the table “bl2memparamsdescs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integ...

CVE-2024-1633 FIP Header Integer Overflow

During the secure boot, bl2 the second stage of the bootloader loops over images defined in the table “bl2memparamsdescs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integ...

GHSA-XFG6-62PX-CXC2 Duplicate Advisory: SQL injection in pgjdbc

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24rp-q3w6-vc56. This link is maintained to preserve external references. Original Description pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not t...

Improper Validation Of Array Index

github.com/greenpau/caddy-security is vulnerable to Improper Validation of Array Index. The vulnerability is due to improper checks when parsing a Caddyfile. Caddy-security fails to validate whether the input values are nil before attempting to access elements, which can lead to a panic index out...

Rensas R-Car rcar_gen3_v2.5 Input Validation Error Vulnerability

The Rensas R-Car is an automotive system-on-chip from Rensas, Japan. It enables high-end computing performance and processes large amounts of information from various sensors installed in the vehicle. A security vulnerability exists in Rensas R-Car rcargen3v2.5 version, which stems from an intege...