Archive
6 October 2022
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Low —
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery
### Vulnerability type Data Validation ### Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. ### References Find out more on this vulnerability…
-
Low —
etcd user credentials are stored in WAL logs in plaintext
### Vulnerability type Data Exposure ### Workarounds The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The…
-
Low —
etcd vulnerable to TOCTOU of gateway endpoint authentication
### Vulnerability type Authentication ### Workarounds Refer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles en…
-
Low 2.6
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to s…
-
Low 3.5
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
-
Low 3.6
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.