Security Bulletin: IBM Storage Fusion HCI is vulnerable to unauthorized access due to a flaw in Ceph RGW.

Summary Ceph is used by IBM Storage Fusion HCI if IBM Storage Fusion HCI is configured with the Data Foundation service. CVE-2023-43040. Vulnerability Details CVEID:CVE-2023-43040 DESCRIPTION: IBM Spectrum Fusion HCI could allow an attacker to perform unauthorized actions in RGW for Ceph due to...

IBM: S3 Bucket Takeover on apptio endpoint

The S3 bucket takeover vulnerability on the Apptio endpoint was reported, analyzed, and remediated. The external researcher who discovered the issue was thanked...

SUSE CVE-2024-34483

OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via OFPBucket.len=0...

The vulnerability of Adobe Audition’s audio editor lies in the overflowing buffer in the “bucket,” allowing a hacker to execute arbitrary code.

The vulnerability of Adobe Audition is related to overflowing buffers in the “bucket” mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

PT-2024-25935

Name of the Vulnerable Software and Affected Versions Faucet SDN Ryu version 4.34 Description The issue allows attackers to cause a denial of service infinite loop via action.len=0 in OFPBucket in parser.py. Recommendations For version 4.34, consider disabling the OFPBucket function in parser.py ...

PT-2024-25934

Name of the Vulnerable Software and Affected Versions Faucet SDN Ryu version 4.34 Description The issue allows attackers to cause a denial of service infinite loop via OFPBucket.len=0 in OFPGroupDescStats in parser.py. Recommendations For version 4.34, consider disabling the OFPGroupDescStats...

kernel: kernel: Denial of Service via memory leak in LRU hash maps

A flaw was found in the Linux kernel. A local user could exploit a memory leak vulnerability in the Least Recently Used LRU and LRUPERCPU hash maps. This occurs when the kernel allocates a new element during a map update but fails to release it if the hash table bucket cannot be locked. Repeated...

CVE-2024-1456

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover...

CVE-2024-1456

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover...

CVE-2024-1456 S3 Bucket Takeover in h2oai/h2o-3

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover...

CVE-2024-1456

CVE-2024-1456 describes an S3 bucket takeover vulnerability in the h2oai/h2o-3 repository involving the bucket http://s3.amazonaws.com/h2o-training. The consolidated data indicate this can lead to unauthorized takeover with high impact on confidentiality and integrity, but no availability impact....

CVE-2024-1456 S3 Bucket Takeover in h2oai/h2o-3

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover...

CVE-2024-28823

Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...

CVE-2024-28823

Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...

Amazon AWS Security Breach

Amazon AWS is a cloud computing platform from the U.S.-based Amazon.com that provides a range of services including information technology infrastructure and applications, such as storage, databases, computing, machine learning, and more, to individuals, businesses, and governments. A security...

PT-2024-22591 · Amazon Aws · Aws-Js-S3-Explorer

Name of the Vulnerable Software and Affected Versions: Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer version 1.0.0 Description: The issue allows for XSS via a crafted S3 bucket name to index.html. This can be exploited when a user interacts with a maliciously named S3 bucket,...

CVE-2024-28823

Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...

SUSE CVE-2021-46993

In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...

DEBIAN-CVE-2021-46993

In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...

UBUNTU-CVE-2021-46993

In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons. However, the size of buckets is currently computed using a rounding division, which can le...