143 matches found
Denial Of Service (DoS)
octo-sts is vulnerable to Denial of Service DoS. The vulnerability is due to missing HTTP request response size checks, which allows an attacker to cause a Denial of Service by flooding the STS service with traffic...
octo-sts 安全漏洞
octo-sts is a Chainguard's GitHub security token service open-sourced by octo-sts. A security vulnerability exists in octo-sts versions prior to 0.1.0, which stems from the fact that an unauthenticated attacker can cause unlimited CPU and memory usage...
octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage
Impact This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. Patches This vulnerability existed in the repository at HEAD, we will cut a 0.1.0 release with the fix. Workarounds None...
GHSA-75R6-6JG8-PFCQ octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage
Impact This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. Patches This vulnerability existed in the repository at HEAD, we will cut a 0.1.0 release with the fix. Workarounds None...
CVE-2024-34079 octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage
octo-sts is a GitHub App that acts like a Security Token Service STS for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0...
CVE-2024-34079
CVE-2024-34079 affects the octo-sts GitHub App (Security Token Service for the GitHub API). The issue enables excessive resource consumption, potentially causing denial of service when handling high traffic volumes. Public sources describe a DoS risk from unbounded resource usage or missing input...
CVE-2024-34079 octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage
octo-sts is a GitHub App that acts like a Security Token Service STS for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0...
CVE-2024-34079 octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage
octo-sts is a GitHub App that acts like a Security Token Service STS for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0...
PT-2024-25689
Name of the Vulnerable Software and Affected Versions octo-sts versions prior to 0.1.0 Description The issue can cause a spike in resource utilization of the STS service. When combined with significant traffic volume, it could potentially lead to a denial of service. Excessively large requests ca...
sts-clan.com Improper Access Control vulnerability OBB-3813015
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Alert: Threat Actors Can Leverage AWS STS to Infiltrate Cloud Accounts
Threat actors can take advantage of Amazon Web Services Security Token Service AWS STS as a way to infiltrate cloud accounts and conduct follow-on attacks. The service enables threat actors to impersonate user identities and roles in cloud environments, Red Canary researchers Thomas Gardner and...
narda-sts.com Cross Site Scripting vulnerability OBB-3804159
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Hotfix to Improve Handling of Self-Signed Certificates Used By On-Prem Object Storage with IAM/STS Endpoints, Agent, VM jobs, and Cloud Connect
Article Applicability The hotfix discussed in this article is only necessary when using an on-prem object storage appliance that utilizes self-signed certificates, and you are being affected in the ways described in the Resolved Issues section. If you are not experiencing the errors listed in thi...
sts-bulgaria.com Cross Site Scripting vulnerability OBB-3657843
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-28433
Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the \ character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key,...
CVE-2022-46830
In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning...
CVE-2022-46830
In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning...
Design/Logic Flaw
In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning...