Archive
29 July 2022
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
High —
mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
### Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance…
-
High 7.5
async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow
### Impact Executing deeply nested queries may cause stack overflow. ### Patches Upgrade to `v4.0.6`
-
High 7.5
chia-blockchain tokens can be inflated to an arbitrary extent
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the toke…
-
High 7.5
Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch
In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in…
-
High 7.5
Timing Attack
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an att…