Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
validator vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2021-41272
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contr...
Linuxfoundation Besu 21.10.0
Linuxfoundation Besu 21.10.1
5
CVSSv2
CVE-2021-3908
OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
Cloudflare Octorpki
Debian Debian Linux 11.0
5
CVSSv2
CVE-2021-3909
OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but do...
Cloudflare Octorpki
Debian Debian Linux 11.0
7.5
CVSSv2
CVE-2021-3907
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code e...
Cloudflare Octorpki
Debian Debian Linux 10.0
Debian Debian Linux 11.0
5
CVSSv2
CVE-2021-3910
OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).
Cloudflare Octorpki
Debian Debian Linux 11.0
4.3
CVSSv2
CVE-2021-3911
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Cloudflare Octorpki
Debian Debian Linux 11.0
4.3
CVSSv2
CVE-2021-3912
OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).
Cloudflare Octorpki
Debian Debian Linux 11.0
5
CVSSv2
CVE-2021-43173
In NLnet Labs Routinator before 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out ...
Nlnetlabs Routinator
Debian Debian Linux 11.0
5
CVSSv2
CVE-2021-43174
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitra...
Nlnetlabs Routinator
Debian Debian Linux 11.0
5
CVSSv2
CVE-2021-43114
FORT Validator versions before 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
Fort Validator Project Fort Validator
Debian Debian Linux 11.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »