227 matches found
Azure CLI Credentials Gatherer
This module will collect the Azure CLI 2.0+ az cli settings files for all users on a given target. These configuration files contain JWT tokens used to authenticate users and other subscription information. Once tokens are stolen from one host, they can be used to impersonate the user from a...
XML External Entity (XXE)
org.cyclonedx:cyclonedx-core-java is vulnerable to XML External Entity XXE.The vulnerability is caused due to improper configuration of the DocumentBuilderFactory used to evaluate XPath expressions to determine the schema version of the BOM before deserializing CycloneDX Bill of Materials in XML...
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
Impact Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the BOM. The DocumentBuilderFactory used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML Extern...
Fedora: Security Advisory for jackson-bom (FEDORA-2024-129d8ca6fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The vulnerability of component BOM in the macOS operating system allows a hacker to disclose sensitive information or cause a service failure.
The vulnerability of component BOM in the macOS operating system is related to reading beyond the memory boundaries. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...
CVE-2023-49569 vulnerabilities
Vulnerabilities for packages: bom, gitness, src-fingerprint, go-licenses, nuclei, pulumi-kubernetes-operator, scorecard, goreleaser, gitsign...
CVE-2023-49569 vulnerabilities
Vulnerabilities for packages: gitness, scorecard, go-licenses, gitsign, goreleaser, nuclei, pulumi-kubernetes-operator, src-fingerprint, bom...
GHSA-449P-3H89-PW88 vulnerabilities
Vulnerabilities for packages: bom, gitness, src-fingerprint, go-licenses, nuclei, pulumi-kubernetes-operator, scorecard, goreleaser, gitsign...
GHSA-449P-3H89-PW88 vulnerabilities
Vulnerabilities for packages: gitness, scorecard, go-licenses, gitsign, goreleaser, nuclei, pulumi-kubernetes-operator, src-fingerprint, bom...
Three Ways To Supercharge Your Software Supply Chain Security
Section four of the "Executive Order on Improving the Nation's Cybersecurity" introduced a lot of people in tech to the concept of a "Software Supply Chain" and securing it. If you make software and ever hope to sell it to one or more federal agencies, you have to pay attention to this. Even if y...
GHSA-X5MR-P6V4-WP93 Field injection in the KirbyData text storage handler
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a contact or comment form. Your Kirby sites are not affected if they don't allow write access for...
Information disclosure
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...
CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect via the comliferaylayoutadminwebportletGroupPagesPortletbackURL parameter in the SEO configuration of the Layout module. An attacker can cause users to be redirected to arbitrary external URLs by tricking them into clickin...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the comliferaylayoutadminwebportletGroupPagesPortletbackURL parameter in the SEO configuration process. An attacker can execute arbitrary code by tricking a user into performing actions through crafte...
CVE-2023-2253 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, kpt, kubernetes-dashboard, aactl, bom...
CVE-2023-2253 vulnerabilities
Vulnerabilities for packages: bom, aactl, kubernetes-dashboard, argocd-image-updater-fips, argocd-image-updater, kpt...
GHSA-HQXW-F8MX-CPMW vulnerabilities
Vulnerabilities for packages: argocd-image-updater, kpt, kubernetes-dashboard, aactl, bom...