Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 2.6.1 GA ]

An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

Cybersecurity researchers have disclosed a privilege escalation vulnerability impacting Google Cloud Platform's Cloud Functions service that an attacker could exploit to access other services and sensitive data in an unauthorized manner. Tenable has given the vulnerability the name...

JetBrains TeamCity Information Disclosure Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool that is primarily used to automate the software build, test, and deployment process. An information disclosure vulnerability exists in JetBrains TeamCity, which stems from a "password"-type parameter that can be disclosed to build logs und...

JetBrains TeamCity < 2024.07 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2024.07. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2024.07 parameters of the password type could leak into the build log in some specific cases CVE-2024-41824 - In JetBrains...

CVE-2023-45249

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure ACI before build 5.0.1-61, Acronis Cyber Infrastructure ACI before build 5.1.1-71, Acronis Cyber Infrastructure ACI before build 5.2.1-69, Acronis Cyber Infrastructure ACI...

SUSE CVE-2024-40897

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of...

CVE-2024-41824

In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases...

CVE-2024-41824

In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases...

CVE-2024-41824: Insertion of Sensitive Information into Log File

In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases...

PT-2024-5486

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.07 Description The issue is related to the exposure of password values in the log file of the continuous integration and delivery system. This could allow a remote attacker to gain unauthorized access ...

JetBrains TeamCity security vulnerabilities

JetBrains TeamCity is a Continuous Integration CI/CD tool that is primarily used to automate the software build, test, and deployment process. An information disclosure vulnerability exists in JetBrains TeamCity, which stems from a "password"-type parameter that can be disclosed to build logs und...

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2024-2024)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 277. Vulnerability Details CVEID:CVE-2023-47038 DESCRIPTION: Perl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the user-defined...

Information Disclosure

github.com/docker/docker is vulnerable to Information Disclosure. The vulnerability is due to the unexpected inclusion of arbitrary filesystem paths in the build context when exploited by a malicious Git repository. Attackers can use this to include sensitive files in the build context without th...

SUSE CVE-2022-48863

In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsppipelinebuild dsppipelinebuild allocates dup pointer by kstrdupcfg, but then it updates dup variable by strsep&dup, "|". As a result when it calls kfreedup, the dup variable contains NULL. Found by...

java-1.8.0-openjdk security update

1.8.0.422.b05-2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.422.b05-1.1 - Update to shenandoah-jdk8u422-b05 GA - Update release notes for shenandoah-8u422-b05. - Rebase PR2462 patch following patched hunk being removed by JDK-8322106 - Switch to GA mode. - Sync the copy of the portab...

GHSA-7G94-HFQC-Q993 Apache StreamPark: Unchecked maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection due to improper validation of parameter input. An attacker can execute arbitrary commands by injecting malicious input into the build parameters. Note: This is only exploitable if the user has system-level...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection due to insufficient validation of input parameters in the maven build process. An attacker can execute arbitrary commands by injecting malicious input into the build parameters. Note: This is only exploitable...

GHSA-5V69-92VW-FMJH Apache StreamPark: maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...