243 matches found
Low: mingw-gcc security and bug fix update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fixes: gcc: uncontrolled recursion in libiberty/rust-demangle.c CVE-2021-46195 For more details about the security issues, including the impact, a CVSS score,...
ada-obrazy.pl Cross Site Scripting vulnerability OBB-3049947
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Talking to our Team about Cybersecurity Careers, on Ada Lovelace Day
Today’s Ada Lovelace Day, and this is a time to highlight the achievements of women in technology, engineering, science, and mathematics, and to encourage girls and women to pursue careers in STEM. Imperva Enterprise Account Managers, Leanora Weaver and Rebecca Kelly, both members of the Imperva...
CVE-2022-33882
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app ADA. An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code...
CVE-2022-33882
CVE-2022-33882 affects Autodesk Desktop App (ADA). Multiple sources describe a vulnerability in ADA’s file-delete/update handling that can be exploited to create an unintended sphere of control, enabling privilege escalation and execution of arbitrary code. ZDI advisories frame this as a local pr...
CVE-2022-33882: Undefined Security Weakness
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app ADA. An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code...
GHSA-7HFP-QFW3-5JXH Helm Vulnerable to denial of service through string value parsing
Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the strvals package that can cause an out of memory panic. Out of memory panics cannot be recovered from. Applications that use functions from the strvals package in the Helm SDK can have a Denial of Service...
GHSA-PMJG-52H9-72QV Argo CD SSO users vulnerable to Cross-site Scripting
Impact All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This vulnerability only affects Argo CD instances which have SSO enabled. The exploit...
gcc bug fix and enhancement update
An update is available for gcc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ad...
GHSA-8F4F-V9X5-CG6J CloudCore UDS Server: Malicious Message can crash CloudCore
Impact A malicious message can crash CloudCore by triggering a null-pointer dereference in the UDS Server. Since the UDS Server only communicates with the CSI Driver on the cloud side, the attack is limited to the local host network. As such, an attacker would already need to be an authenticated...
Argo CD's external URLs for Deployments can include JavaScript
Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...
MAL-2022-844 Malicious code in ada-balance-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6727c4df16febb1399cae1caa5604a2441a91be359ed453d105095de36d6bb03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ada-balance-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6727c4df16febb1399cae1caa5604a2441a91be359ed453d105095de36d6bb03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-QPGX-64H2-GC3C Insecure path traversal in Git Trigger Source can lead to arbitrary file read
Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...
Insecure path traversal in Git Trigger Source can lead to arbitrary file read
Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...
GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints
Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...
Uses of deprecated API can be used to cause DoS in user-facing endpoints
Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...
RLSA-2021:4386 Low: gcc security and bug fix update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fixes: libiberty: Integer overflow in demangletemplate function CVE-2018-20673 For more details about the security issues, including the impact, a CVSS score,...
Low: gcc security and bug fix update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fixes: libiberty: Integer overflow in demangletemplate function CVE-2018-20673 For more details about the security issues, including the impact, a CVSS score,...
Doldrums - A Flutter/Dart Reverse Engineering Tool
To flutter: to move in quick, irregular motions, to beat rapidly, to be agitated. Doldrums: a period of stagnation. Doldrums is a reverse engineering tool for Flutter apps targetting Android. Concretely, it is a parser and information extractor for the Flutter/Dart Android binary, conventionally...