CVE-2023-41332 Denial of service via Kubernetes annotations in specific Cilium configurations

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 or io.cilium.proxy-visibility annotations in Cilium...

CVE-2023-41332 Denial of service via Kubernetes annotations in specific Cilium configurations

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 or io.cilium.proxy-visibility annotations in Cilium...

PT-2023-27909 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.14.2 Cilium versions prior to 1.13.7 Cilium versions prior to 1.12.14 Description: In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility...

CVE-2023-40029

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

Cross-Site Request Forgery (CSRF)

wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. Through the use of a malicious GET request to the /reset/annotations, /reset/entries, /reset/tags, or /reset/archived endpoints, an attacker is able to arbitrary reset annotations, entries, and tags...

poppler:qt_annot_fuzzer: Use-of-uninitialized-value in aesEncryptBlock

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4848722310463488 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

Wallabag user can reset data unintentionally

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...

PT-2023-26310 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open a...

PT-2023-4413 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the...

PT-2023-4414 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the...

Incorrect control flow in gradle breaks credentials masking in the build log

gradle 2.8 improperly invokes APIs available only on the controller from an agent when setting up build log annotations, causing an exception. As a result, credentials may not be masked i.e., replaced with asterisks in the build log in some circumstances. gradle 2.8.1 improves the control flow an...

com.carrotgarden.maven:bintray-maven-plugin (>=1.4.20190427204453, <=1.5.20191113165555), com.carrotgarden.maven:maven-plugin-tools-annotations (1.2.20190427171248) +6 more potentially affected by CVE-2023-37460 via org.codehaus.plexus:plexus-archiver (3.4.1)

org.codehaus.plexus:plexus-archiver MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.carrotgarden.maven:bintray-maven-plugin =1.4.20190427204453, =0.1.1, =3.0.1, =3.1.5 -...

CVE-2023-33876

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. ...

PT-2023-3891 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 12.1.2.15332 Description: A use-after-free vulnerability exists in the way Foxit Reader handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously...

org.eclipse.jetty:jetty-annotations (7.0.0.m0), org.eclipse.jetty:jetty-deploy (7.0.0.m0) +8 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.m0)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty:jetty-annotations 7.0.0.m0 - org.eclipse.jetty:jetty-deploy 7.0.0.m0 -...

org.eclipse.jetty:jetty-annotations (7.0.0.m1), org.eclipse.jetty:jetty-deploy (7.0.0.m1) +10 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.m1)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty:jetty-annotations 7.0.0.m1 - org.eclipse.jetty:jetty-deploy 7.0.0.m1 -...

maven bug fix and enhancement update

An update is available for plexus-interpolation, httpcomponents-core, maven-wagon, maven, google-guice, jsoup, jansi, apache-commons-io, apache-commons-lang3, maven-shared-utils, plexus-utils, plexus-classworlds, jakarta-annotations, httpcomponents-client, apache-commons-codec, plexus-cipher,...

Adobe Acrobat Reader DC Annotation Highlight popupOpen Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

jackson security update

jackson-annotations 2.14.1-1 - Update to version 2.14.1 - Resolves: 2070122 jackson-core 2.14.1-1 - Update to version 2.14.1 - Resolves: 2070122 jackson-databind 2.14.1-1 - Update to version 2.14.1 - Resolves: 2070122 jackson-jaxrs-providers 2.14.1-1 - Update to version 2.14.1 - Resolves: 2070122...

MAL-2023-763 Malicious code in schema2x-annotations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14cc8a264046041e2d275a0a2e465eb74b50c5ff3824a6330b7253196e8b6fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...