PT-2024-4437 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KC RESTART cookie returned by the...

CVE-2024-34525

CVE-2024-34525 affects FileCodeBox 2.0, where a cleartext environment file stores sensitive credentials (OneDrive password and AWS key). Root cause is storing credentials in an unencrypted env file, enabling potential unauthorized access if the file is exposed. Documented remediation/recommendati...

CVE-2024-34525

FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file...

GitLab 7.8 < 16.9.6 / 16.10 < 16.10.4 / 16.11 < 16.11.1 (CVE-2024-4024)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1...

PT-2024-25250 · Phiola · Phiola

Name of the Vulnerable Software and Affected Versions: phiola version 2.0-rc22 Description: The issue is a Buffer-Overflow vulnerability located at pcm convert.h:513. This vulnerability allows a remote attacker to execute arbitrary code via a crafted .wav file. Recommendations: For phiola version...

RHEL 8 : Jenkins and Jenkins-2-plugins (RHSA-2024:0778)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0778 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

RHEL 8 : OpenShift Container Platform 4.10.51 (RHSA-2023:0560)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0560 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 8 : Red Hat Ansible Automation Platform 2.0 ansible-runner (RHSA-2022:0474)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0474 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can...

BIT-GITLAB-2024-4024 Authentication Bypass by Assumed-Immutable Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take...

WordPress Fan Page Widget by ThemeNcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Fan Page Widget by ThemeNcode Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33695 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 65bb7cdeaec7 Credits Joshua Chan Required privile...

Slackware: Security Advisory (SSA:2024-116-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-4024

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take...

CVE-2024-4024

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take...

CVE-2024-4024 Authentication Bypass by Assumed-Immutable Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take...

CVE-2024-4024 Authentication Bypass by Assumed-Immutable Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take...

CVE-2024-4024

CVE-2024-4024 affects GitLab CE/EE with versions 7.8–16.9.6, 16.10 before 16.10.4, and 16.11 before 16.11.1. Under certain conditions, an attacker with Bitbucket credentials could take over a GitLab account linked to another user’s Bitbucket account when Bitbucket is used as an OAuth 2.0 provider...

CVE-2024-4024

Removed by vendor...

FreeBSD : Gitlab -- vulnerabilities (b857606c-0266-11ef-8681-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b857606c-0266-11ef-8681-001b217b3468 advisory. - An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all...

CBL Mariner 2.0 Security Update: cri-o (CVE-2022-1708)

The version of cri-o installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1708 advisory. - A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with...

CBL Mariner 2.0 Security Update: fluent-bit (CVE-2024-23722)

The version of fluent-bit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23722 advisory. - In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload...