ZZZCMS Security Breach

ZZZCMS is a content management system CMS. A security vulnerability exists in ZZZCMS version 2.2.0, which originates from a cross-site scripting XSS vulnerability in the Personal Profile page...

CVE-2023-45267

Cross-Site Request Forgery CSRF vulnerability in Zizou1988 IRivYou plugin = 2.2.1 versions...

OESA-2023-1717 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

PT-2023-27815 · WordPress · Jonk @ Follow Me Darling Sp*Tify Play Button

Name of the Vulnerable Software and Affected Versions: Jonk @ Follow me Darling Sptify Play Button for WordPress plugin versions = 2.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performi...

PT-2023-6292

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.58 Description The issue is related to the handling of HTTP/2 streams in the Apache HTTP Server. When a client resets an HTTP/2 stream using an RST frame, there is a time window where the request's memo...

Tencent WeChat Security Breach

Tencent WeChat 微信 is an online social networking application from the Chinese company Tencent. The program supports sending voice messages, videos, pictures, and texts. A security vulnerability exists in Tencent Wechat Privatization version 2.5.x and version 2.6.930000, which stems from the...

AZL-31608 CVE-2023-39325 affecting package blobfuse2 for versions less than 2.1.1-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-31655 CVE-2023-39325 affecting package vitess for versions less than 16.0.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

UBUNTU-CVE-2023-39325

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

SUSE CVE-2023-39325

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

The vulnerability of the HTTP/2 protocol lies in its ability to create request streams within an already established network connection, without the need to establish new connections or confirm the receipt of packets. This allows attackers to cause service failures.

The vulnerability of the HTTP/2 protocol lies in the ability to create request streams within an already established network connection, without the need to establish new network connections or confirm the receipt of packets. Exploiting this vulnerability allows a malicious actor to cause service...

GHSA-QPPJ-FM5R-HXR3 HTTP/2 Stream Cancellation Attack

HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...

kernel: Spectre v2 SMT mitigations problem

It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes...

AZL-31324 CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2

Summary Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service DDoS attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability CVE-2023-44487 impacts any internet exposed HTTP/2 endpoints. As an...

ChiefOnboarding Cross-Site Request Forgery Vulnerability

ChiefOnboarding is a free and open source employee onboarding platform. A cross-site request forgery vulnerability exists in versions prior to ChiefOnboarding v2.0.47, which stems from a cross-site request forgery CSRF vulnerability in...

PT-2023-13009 · Sinec Nms · Sinec Nms

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V2.0 Description: A vulnerability has been identified in the affected application, where it assigns improper access rights to specific folders containing executable files and libraries. This could allow an...

PT-2023-5873 · Libcue +6 · Libcue +6

Name of the Vulnerable Software and Affected Versions: libcue versions 2.2.1 and prior Description: The issue is related to out-of-bounds array access in libcue, which provides an API for parsing and extracting data from CUE sheets. A user of the GNOME desktop environment can be exploited by...

Delta Electronics WPLSoft Security Vulnerability

Delta Electronics WPLSoft is a software tool for programming Delta Programmable Logic Controllers PLCs from Delta Electronics, Inc. of Taiwan, China. A security vulnerability exists in Delta Electronics WPLSoft version 2.51, which originates from the transmission of sensitive information in clear...