Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to missing length validation in the WTCLOSESESSION capsule parser. An attacker can exhaust system memory by sending a capsule with an excessively large Application Error Message...

CVE-2024-36984 Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code...

CVE-2024-36984 Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code...

Remote Code Execution (RCE)

illuminate/cookie is vulnerable to Remote Code Execution RCE. The vulnerability is due to applications using the "cookie" session driver combined with exposure of an encryption oracle, which allows an attacker to craft valid Laravel session payloads...

GHSA-QM5C-M76R-2HFR Laravel RCE vulnerability in "cookie" session driver

Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the use...

CVE-2023-40595 Remote Code Execution via Serialized Session Payload

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code...

specially crafted sessions can cause access to files via path traveral

Using a special crafted cURL request it is under strict conditions possible to access arbitrary files the webserver has access to. This requires you to use file-based sessions, a specific directory to exist on your server, and session payload encryption to be switched off. All released versions...