CVE-2024-23323

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and...

Cross site request forgery (csrf)

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and...

CVE-2024-23323 Excessive CPU usage when URI template matcher is configured using regex in Envoy

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and...

CVE-2024-23323

Envoy CVE-2024-23323 affects the Envoy proxy where the regex matcher is compiled per request, causing high CPU and increased latency when multiple routes use such matchers. The issue has specific fixes in released versions 1.29.1, 1.28.1, 1.27.3, and 1.26.7; upgrading is advised. The provided doc...

CVE-2024-23323 Excessive CPU usage when URI template matcher is configured using regex in Envoy

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and...

CVE-2024-23323 Excessive CPU usage when URI template matcher is configured using regex in Envoy

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and...

CVE-2023-6716

Rejected reason: REJECT DO NOT USE THIS CVE RECORD. All references and descriptions in this record have been removed to prevent accidental usage...

PT-2024-3051 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.7 Envoy versions prior to 1.27.3 Envoy versions prior to 1.28.1 Envoy versions prior to 1.29.1 Description: The issue is related to a high-performance edge/middle/service proxy, where the regex expression is...

CVE-2023-49101

WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates...

PT-2024-20806 · L8W8Jwt · L8W8Jwt

Name of the Vulnerable Software and Affected Versions: l8w8jwt version 2.2.1 Description: The issue arises from the use of memcmp to verify authentication, which is not constant time. This makes it easier to bypass authentication via a timing side channel. Recommendations: For l8w8jwt version...

PT-2024-2322

Name of the Vulnerable Software and Affected Versions ip package versions prior to 1.1.9 Description The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic function. This can lead to security issues such as Server-Side Request Forgery SSR...

CKEditor cross-site scripting vulnerability in AJAX sample

Affected packages The vulnerability has been discovered in the AJAX sample available at the samples/old/ajax.html file location. All integrators that use that sample in the production code can be affected. Impact A potential vulnerability has been discovered in one of CKEditor's 4 samples that ar...

PT-2024-14946 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.11 through 16.6.6 GitLab CE/EE versions 16.7 through 16.7.4 GitLab CE/EE versions 16.8 through 16.8.1 Description: A denial of service issue was identified in GitLab CE/EE, which allows an attacker to increase the...

No License consumption after changing the License type

After changing the License type to concurrent the Licenses were not consumed License usage showed as 0 Used...

python-multipart Resource Management Error Vulnerability

python-multipart is a streaming multipart parser for Python by the individual developer Marcelo Trylesinski. A resource management error vulnerability exists in versions prior to python-multipart 0.0.7, which stems from the package python-multipart consuming CPU resources and stopping indefinitel...

CVE-2024-22667

Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions...

Browser-based Application's Page Fails to Load With: ERR_SSL_KEY_USAGE_INCOMPATIBLE

Article Applicability The error discussed in this article is caused by a misconfiguration of the website's certificate. Specifically, the ERRSSLKEYUSAGEINCOMPATIBLE error occurs when the certificate used by a website has a KeyUsage value defined, but it does not include "Digital Signature" and...

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...

PT-2024-1623 · Qnap · Qnap Qts +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.5.2645 build 20240116 QNAP QuTS hero versions prior to h5.1.5.2647 build 20240118 QNAP QuTScloud versions prior to c5.1.5.2651 Description: An uncontrolled resource consumption issue has been reported, potential...

Optimizing Data Lakes: Streamlining Storage with Effective Object Management

Data lakes are a popular solution for data storage, and for good reason. Data lakes are flexible and cost effective, as they allow multiple query engines and many object formats without the need to manage resources like disks, CPUs, and memory. In a data lake, data is simply stored in an object...