Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId..…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId..…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki