Most recent entries from bitnami_vulndb

BIT-golang-2021-33194

Wed, 06 Mar 2024 11:05:26 +0000

Affected: Bitnami: golang

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.

BIT-mariadb-2022-27458

Wed, 06 Mar 2024 10:58:21 +0000

Affected: Bitnami: mariadb

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.

BIT-postgresql-2024-24213

Wed, 06 Mar 2024 11:02:10 +0000

Affected: Bitnami: postgresql

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.

BIT-rabbitmq-2020-5419

Wed, 06 Mar 2024 11:04:02 +0000

Affected: Bitnami: rabbitmq

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.

BIT-rabbitmq-2021-22117

Wed, 06 Mar 2024 11:03:44 +0000

Affected: Bitnami: rabbitmq

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

BIT-kafka-2024-27309

Tue, 16 Apr 2024 07:20:25 +0000

Affected: Bitnami: kafka

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.Two preconditions are needed to trigger the bug:1. The administrator decides to remove an ACL2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.

BIT-solr-2023-44487

Wed, 06 Mar 2024 11:05:51 +0000

Affected: Bitnami: solr

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

BIT-wordpress-2023-28492

Thu, 18 Jul 2024 07:44:25 +0000

Affected: Bitnami: wordpress

Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: from n/a through 1.4.10.

BIT-envoy-2024-7207

Thu, 26 Sep 2024 07:10:09 +0000

Affected: Bitnami: envoy

A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.

BIT-gitlab-2022-4315

Tue, 05 Nov 2024 07:26:59 +0000

Affected: Bitnami: gitlab

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.