DeutschShown in its original language — a full translation is planned for a future version.
IBM MQ Operator and Queue manager: Mehrere Schwachstellen
view advisory published 2023-12-13
Ein Angreifer kann mehrere Schwachstellen in IBM MQ Operator and Queue manager ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-4641US | medium5.5 | — | ||
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning… | ||||
| CVE-2023-39325US | high7.5 | Exploit | ||
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded… | ||||
| CVE-2023-44487US | high7.5OT critical | KEV | ||
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through… | ||||
| CVE-2023-43804US | high8.1 | Exploit | ||
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the… | ||||
| CVE-2023-39319US | medium6.1 | — | ||
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the… | ||||
| CVE-2023-39318US | medium6.1 | — | ||
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improp… | ||||
| CVE-2023-3978US | medium6.1 | — | ||
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. | ||||
| CVE-2023-29409US | medium5.3 | Exploit | ||
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during hand… | ||||
| CVE-2023-4016US | low3.3 | — | ||
Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the… | ||||
| CVE-2022-41723US | high7.5OT elevated | — | ||
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. | ||||
| CVE-2023-25173US | high7.8OT elevated | — | ||
containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a contai… | ||||
| CVE-2023-25153US | medium5.5 | — | ||
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A… | ||||
| CVE-2022-41717US | medium5.3 | Exploit | ||
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the… | ||||
| CVE-2022-23471US | medium6.5 | — | ||
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutin… | ||||
| CVE-2022-31030US | medium5.5 | — | ||
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan