69 matches found
CVE-2026-93852
In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...
EUVD-2026-83275
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...
CVE-2026-93854
In OpenStack Blazar before 17.0.1 , the V2 lease API fails to enforce object-level authorization on update and delete operations due to a parameter name mismatch : the authorize() wrapper looks up the lease under the keyword "lease_id" while the controller methods name the parameter "id" (deliver...
CVE-2026-93852
OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...
EUVD-2026-83273
In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...
Fedora 42 : linux-firmware (2025-ecd9a3485b)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ecd9a3485b advisory. Upstream linux-firmware 20251111 release: rtlbt: Update RTL8922A BT USB firmware to 0x41C0C905 add firmware for mt7987 internal 2.5G ethernet phy rtw88: 8822...
EUVD-2025-179654
Malicious code in command-blazar-node-config-phylogenetics npm...
EUVD-2025-180036
Malicious code in blazar-draco-mesosphere-mineralogy npm...
EUVD-2025-180301
Malicious code in astro-photon-publish-blazar npm...
EUVD-2025-176652
Malicious code in reveal-md-cladistics-brane-blazar npm...
EUVD-2025-179149
Malicious code in enceladus-mdx-zenobia-blazar npm...
EUVD-2025-176034
Malicious code in technosignature-wezen-blitz-blazar npm...
EUVD-2025-179491
Malicious code in cryonics-blazar-nightwatch-inflation npm...
EUVD-2025-180032
Malicious code in blazar-quark-publish-quito npm...
Malicious code in chai-blazar-quasar-link (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 128176b0ea3dd4cd1df472e8b25d1a0d98e84d2b8f1a03ae9e5ad8efb29eeab1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in reveal-md-cladistics-brane-blazar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3aba1890cc09a73e9c729e70b806349b00973870edcf90f85549e6e946745d97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178939
Malicious code in farout-resolvers-photon-blazar npm...
EUVD-2025-180037
Malicious code in blazar-apollo-async-barnard npm...