CVE-2022-1561

MEDIUM Year: 2022
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-471
View all →

Vulnerability Description

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Related Vulnerabilities

CVE-2021-37193

MEDIUM
CVSS:4.3(Medium)

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could manipulate certain parameter...

CWE-4712021

CVE-2022-3288

MEDIUM
CVSS:4.3(Medium)

A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the defau...

CWE-4712022

CVE-2020-26268

MEDIUM
CVSS:4.4(Medium)

In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is...

CWE-4712020

CVE-2024-51462

MEDIUM
CVSS:4.0(Medium)

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data.

CWE-4712024

CVE-2021-24046

MEDIUM
CVSS:5.3(Medium)

A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device ...

CWE-4712021

CVE-2023-46232

MEDIUM
CVSS:5.3(Medium)

era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initia...

CWE-4712023