CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1428 – Denial-of-Service in gRPC
https://notcve.org/view.php?id=CVE-2023-1428
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above. • https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8 • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7768 – Prototype Pollution
https://notcve.org/view.php?id=CVE-2020-7768
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. El paquete grpc versiones anteriores a 1.24.4; el paquete @grpc/grpc-js versiones anteriores a 1.1.8, son vulnerables a una contaminación de prototipo por medio de loadPackageDefinition • https://github.com/grpc/grpc-node/pull/1605 https://github.com/grpc/grpc-node/pull/1606 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819 https://snyk.io/vuln/SNYK-JS-GRPC-598671 https://snyk.io/vuln/SNYK-JS-GRPCGRPCJS-1038818 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •