Microsoft Azure SDK Security Vulnerability

Microsoft Azure SDK is a code base from Microsoft that supports interaction with programming languages to manage Azure. A security vulnerability exists in Microsoft Azure SDK. An attacker could exploit this vulnerability to perform spoofing attacks...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious party could exploit the vulnerabilities to gain elevated privileges and potentially execute arbitrary code with elevated privileges, or gain access to sensitive data. The most serious vulnerability is located in the...

PT-2024-2105 · Ibm · Ibm Qradar Siem On Azure Cloud

Name of the Vulnerable Software and Affected Versions: Open Management Infrastructure OMI versions prior to the fixed version IBM QRadar SIEM on Azure Cloud versions 7.3.3 through 7.5.0 Description: The Open Management Infrastructure OMI Remote Code Execution Vulnerability is related to the use o...

Microsoft Open Management Infrastructure Security Vulnerability

Microsoft Open Management Infrastructure is a free, open source Common Information Model CIM management server from Microsoft. A security vulnerability exists in Microsoft Open Management Infrastructure. An attacker could exploit this vulnerability to gain elevated privileges. The following...

PT-2024-2191 · Microsoft · Azure Data Studio

Name of the Vulnerable Software and Affected Versions: Azure Data Studio affected versions not specified Description: The issue is related to insufficient access control in Azure Data Studio, which can be exploited to elevate privileges. Recommendations: At the moment, there is no information abo...

PT-2024-2791 · Microsoft · Azure Private 5G Core

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Private 5G Core affected versions not specified Description: The issue is related to improper input validation in the InitialUEMessage processing, which can lead to a denial-of-service condition. This can be exploited by a...

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Affected version Vendor: https://github.com/latchset/jwcrypto Version: 1.5.5 Description An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this Token, it will consume a lot of memory and processing time. Poc python from...

GHSA-J857-7RVV-VJ97 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Affected version Vendor: https://github.com/latchset/jwcrypto Version: 1.5.5 Description An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this Token, it will consume a lot of memory and processing time. Poc python from...

BIT-JASPERREPORTS-2022-22773

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Serv...

BIT-JASPERREPORTS-2022-41563

The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure,...

BIT-GRAFANA-2023-3128

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

BIT-AZURE-CLI-2022-39327 Improper Control of Generation of Code ('Code Injection') in Azure CLI

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. T...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: cosign, secrets-store-csi-driver-provider-gcp, terraform-provider-google, metrics-server, newrelic-infra-operator, minio, spicedb, flux, aws-flb-kinesis, syft, sops, trillian, k9s, golangci-lint, tekton-chains, kubevela, k3s, kine, doppler-kubernetes-operator,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: certificate-transparency, minio-fips, volume-modifier-for-k8s, newrelic-infrastructure-agent, nerdctl, certificate-transparency-fips, falcosidekick-fips, newrelic-infra-operator, crossplane-provider-aws-eks, prometheus-beat-exporter, metrics-server,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, dockerize, secrets-store-csi-driver-provider-gcp, src-fingerprint, metrics-server, newrelic-infra-operator, minio, flux, aws-flb-kinesis, govulncheck, trillian, golangci-lint, kubevela, k3s, kine, doppler-kubernetes-operator, terraform,...

BloodHound - Six Degrees Of Domain Admin

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound uses graph...

openSUSE: Security Advisory for the Linux Kernel (SUSE-SU-2023:4345-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for the Linux Kernel (SUSE-SU-2023:0774-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cannot Create Catalog from Azure VM with Trusted Launch Enabled

Error Attempting to create a catalog using an Azure Trusted Launch enabled image results in the following error: "CreateTerminatingError in operation PreparingMasterImage with message Error starting machine. Security type of VM is not compatible with the security type of attached OS Disk." Soluti...

Ubuntu: Security Advisory (USN-6647-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...