CVE-2024-25639

CVE-2024-25639 affects Khoj’s Obsidian, Desktop and Web clients, where inadequate sanitization of AI model responses and user inputs enables Cross Site Scripting via Prompt Injection from untrusted documents loaded for indexing or fetched from the internet when the /online command is used. The vu...

CVE-2024-25639 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients

Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting XSS via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by...

GO-2024-2449 Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport

Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

PT-2024-40542

Name of the Vulnerable Software and Affected Versions: github.com/gravitational/teleport versions prior to 12.4.31 github.com/gravitational/teleport versions 13.0.0 through 13.4.12 github.com/gravitational/teleport versions 14.0.0 through 14.2.3 Description: The issue allows execution on macOS...

Malicious code in mac-agents-cdk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2644 Malicious code in mac-agents-cdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Using LLMs to Exploit Vulnerabilities

Interesting research: "Teams of LLM Agents can Exploit Zero-Day Vulnerabilities." Abstract: LLM agents have become increasingly sophisticated, especially in the realm of cybersecurity. Researchers have shown that LLM agents can exploit real-world vulnerabilities when given a description of the...

The vulnerability of the data collection tool for Azure Monitor Agents from virtual machines and physical servers arises from incorrect handling of the link before accessing the file. This allows attackers to escalate their privileges.

The vulnerability of the data collection tool for Azure Monitor Agents, which are used for monitoring virtual machines and physical servers, is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow attackers to increase their privilege...

OPENSUSE-SU-2024:10752-1 fence-agents-4.10.0+git.1627556580.31443c15-1.2 on GA media

These are all security issues fixed in the fence-agents-4.10.0+git.1627556580.31443c15-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10237-1 fence-agents-4.0.24+git.1480563949.e67fcd4-1.1 on GA media

These are all security issues fixed in the fence-agents-4.0.24+git.1480563949.e67fcd4-1.1 package on the GA media of openSUSE Tumbleweed...

resource-agents bug fix update

An update is available for resource-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The resource-agents packages provide the Pacemaker and RGManager...

RLSA-2024:3820 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: jinja2: accepts keys containing non-attribute characters CVE-2024-34064...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

fence-agents security and bug fix update

An update is available for fence-agents. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

RLSA-2024:2968 Moderate: fence-agents security and bug fix update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: Request body not stripped after redirect from 303 status chang...

Rocky Linux 8 : fence-agents (RLSA-2024:2968)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2968 advisory. urllib3: Request body not stripped after redirect from 303 status changes request method to GET CVE-2023-45803 pycryptodome: side-channel leakage for OA...

AlmaLinux 9 : fence-agents (ALSA-2024:3820)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:3820 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 Tenable has extracted the preceding description block directly from the AlmaLinux security...

Rocky Linux 9 : fence-agents (RLSA-2024:3820)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3820 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 Tenable has extracted the preceding description block directly from the Rocky Linux...

RHEL 8 : fence-agents (RHSA-2024:3811)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3811 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

RHEL 9 : fence-agents (RHSA-2024:3820)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3820 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...