CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3337 – Lock WARP switch bypass by removing VPN profile on iOS mobile client
https://notcve.org/view.php?id=CVE-2022-3337
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform. Un usuario podía eliminar un perfil VPN del cliente móvil WARP en la plataforma iOS a pesar del interruptor Lock WARP https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/# La función lock-warp-switch está habilitada en Zero Trust Platform. Esto llevó a eludir las políticas y restricciones impuestas a los dispositivos inscritos por la plataforma Zero Trust. • https://github.com/cloudflare/advisories/security/advisories/GHSA-vr93-4vx7-332p • CWE-290: Authentication Bypass by Spoofing CWE-862: Missing Authorization •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3321 – Lock WARP switch feature bypass on WARP mobile client for iOS
https://notcve.org/view.php?id=CVE-2022-3321
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform. Fue posible omitir la función de interruptor Lock WARP https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch en el cliente móvil WARP iOS habilitando ambos Los cambios ""Disable for cellular networks"" y ""Disable for Wi-Fi networks"" a la vez en la configuración de la aplicación. Dicha configuración provocó que el cliente WARP se desconectara y permitió al usuario eludir las restricciones y políticas impuestas por la plataforma Zero Trust. • https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3512 – Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
https://notcve.org/view.php?id=CVE-2022-3512
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint. Al utilizar el comando warp-cli ""add-trusted-ssid"", un usuario pudo desconectar el cliente WARP y omitir la función ""Lock WARP switch"", lo que provocó que las políticas Zero Trust no se aplicaran en un terminal afectado. • https://github.com/cloudflare/advisories/security/advisories/GHSA-3868-hwjx-r5xf • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3616 – OctoRPKI crash when maximum iterations number is reached
https://notcve.org/view.php?id=CVE-2022-3616
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability. Los atacantes pueden crear largas cadenas de CA que llevarían a OctoRPKI a exceder su parámetro máximo de iterations. En consecuencia provocaría que el programa colapsara, impidiendo que finalice la validación y provocando una Denegación de Servicio. • https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc • CWE-754: Improper Check for Unusual or Exceptional Conditions CWE-834: Excessive Iteration •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2529 – Multiple DoS Attack Vectors in sflow packet handling
https://notcve.org/view.php?id=CVE-2022-2529
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service. El paquete de decodificación sflow no emplea suficiente sanitización de paquetes, lo que puede llevar a un ataque de denegación de servicio. Los atacantes pueden elaborar paquetes malformados haciendo que el proceso consuma grandes cantidades de memoria, lo que provoca una denegación de servicio • https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •