Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input
Vulnerability Description
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
不加限制或调节的资源分配
Vulnerability Title
Faktory 安全漏洞
Vulnerability Description
Faktory是一个工作服务器。它是应用程序中后台作业的存储库。作业有一个类型和一组参数，并被放入队列中供工作人员获取和执行。 Faktory 1.8.0 之前版本存在安全漏洞，该漏洞源于Faktory Web 仪表板可能会因精心设计的恶意 URL 查询参数days而遭受拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A