#ExploitObserverAlert
CVE-2024-24747
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24747. MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
FIRST-EPSS: 0.000580000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.7162829
CVE-2024-24747
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24747. MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
FIRST-EPSS: 0.000580000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.7162829
#ExploitObserverAlert
CVE-2024-2279
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-2279. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
CVE-2024-2279
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-2279. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2024-28834
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2024-28834. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.723201
CVE-2024-28834
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2024-28834. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.723201
#ExploitObserverAlert
CVE-2024-24576
DESCRIPTION: Exploit Observer has 67 entries in 13 file formats related to CVE-2024-24576. Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.6898125
CVE-2024-24576
DESCRIPTION: Exploit Observer has 67 entries in 13 file formats related to CVE-2024-24576. Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.6898125
#ExploitObserverAlert
CVE-2024-22667
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-22667. Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.688607
CVE-2024-22667
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-22667. Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.688607
#ExploitObserverAlert
CVE-2023-6019
DESCRIPTION: Exploit Observer has 16 entries in 3 file formats related to CVE-2023-6019. A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
FIRST-EPSS: 0.000970000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9157136
CVE-2023-6019
DESCRIPTION: Exploit Observer has 16 entries in 3 file formats related to CVE-2023-6019. A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
FIRST-EPSS: 0.000970000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9157136
#ExploitObserverAlert
CVE-2023-6678
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2023-6678. An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
CVE-2023-6678
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2023-6678. An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2023-6129
DESCRIPTION: Exploit Observer has 13 entries in 5 file formats related to CVE-2023-6129. Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
FIRST-EPSS: 0.000610000
NVD-IS: 4.2
NVD-ES: 2.2
ARPS-EXPLOITABILITY: 0.7505797
CVE-2023-6129
DESCRIPTION: Exploit Observer has 13 entries in 5 file formats related to CVE-2023-6129. Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
FIRST-EPSS: 0.000610000
NVD-IS: 4.2
NVD-ES: 2.2
ARPS-EXPLOITABILITY: 0.7505797
#ExploitObserverAlert
CVE-2024-24795
DESCRIPTION: Exploit Observer has 4 entries in 1 file formats related to CVE-2024-24795. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.7214286
CVE-2024-24795
DESCRIPTION: Exploit Observer has 4 entries in 1 file formats related to CVE-2024-24795. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.7214286
#ExploitObserverAlert
CVE-2024-21508
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.7512425
CVE-2024-21508
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.7512425
#ExploitObserverAlert
CVE-2023-0342
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-0342. MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
FIRST-EPSS: 0.000460000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9205301
CVE-2023-0342
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-0342. MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
FIRST-EPSS: 0.000460000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9205301
#ExploitObserverAlert
CVE-2024-1441
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2024-1441. An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.6969988
CVE-2024-1441
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2024-1441. An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.6969988
#ExploitObserverAlert
CVE-2023-2700
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-2700. A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.
FIRST-EPSS: 0.000420000
NVD-IS: 3.6
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.7000953
CVE-2023-2700
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-2700. A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.
FIRST-EPSS: 0.000420000
NVD-IS: 3.6
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.7000953
#ExploitObserverAlert
CVE-2024-31080
DESCRIPTION: Exploit Observer has 21 entries in 6 file formats related to CVE-2024-31080. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7065507
CVE-2024-31080
DESCRIPTION: Exploit Observer has 21 entries in 6 file formats related to CVE-2024-31080. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7065507
#ExploitObserverAlert
CVE-2023-50868
DESCRIPTION: Exploit Observer has 37 entries in 8 file formats related to CVE-2023-50868. The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
FIRST-EPSS: 0.000460000
ARPS-EXPLOITABILITY: 0.7531041
CVE-2023-50868
DESCRIPTION: Exploit Observer has 37 entries in 8 file formats related to CVE-2023-50868. The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
FIRST-EPSS: 0.000460000
ARPS-EXPLOITABILITY: 0.7531041
#ExploitObserverAlert
CVE-2024-3092
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-3092. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
CVE-2024-3092
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-3092. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2024-21509
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-21509. Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.775
CVE-2024-21509
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-21509. Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2021-21238
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2021-21238. PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.
FIRST-EPSS: 0.001070000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.6908515
CVE-2021-21238
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2021-21238. PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.
FIRST-EPSS: 0.001070000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.6908515
#ExploitObserverAlert
CVE-2023-46724
DESCRIPTION: Exploit Observer has 18 entries in 4 file formats related to CVE-2023-46724. Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
FIRST-EPSS: 0.006100000
NVD-IS: 3.6
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7187882
CVE-2023-46724
DESCRIPTION: Exploit Observer has 18 entries in 4 file formats related to CVE-2023-46724. Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
FIRST-EPSS: 0.006100000
NVD-IS: 3.6
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7187882
#ExploitObserverAlert
CVE-2024-24786
DESCRIPTION: Exploit Observer has 18 entries in 5 file formats related to CVE-2024-24786. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7602171
CVE-2024-24786
DESCRIPTION: Exploit Observer has 18 entries in 5 file formats related to CVE-2024-24786. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7602171
#ExploitObserverAlert
CVE-2024-25617
DESCRIPTION: Exploit Observer has 7 entries in 2 file formats related to CVE-2024-25617. Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7046419
CVE-2024-25617
DESCRIPTION: Exploit Observer has 7 entries in 2 file formats related to CVE-2024-25617. Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7046419