CVE-2024-5721

Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific...

CVE-2024-23445

CVE-2024-23445 affects Elasticsearch remote-cluster API key security model (GA 8.14.0). The issue: a cross-cluster API key that restricts index search via query or field_security and also grants replication for the same index may not enforce search restrictions during cross-cluster search, potent...

CVE-2024-23445 Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions

It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.htmlsecurity-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the fieldsecurity parameter, an...

CVE-2024-23445 Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions

It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.htmlsecurity-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the fieldsecurity parameter, an...

PT-2024-37098 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit...

CVE-2024-23445: Insecure Storage of Sensitive Information

It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.htmlsecurity-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the fieldsecurity parameter, an...

Akamai Adds Support for Kubernetes Cluster API

...

kubernetes-cluster-api:fuzz_yaml_parser: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4825565785620480 Project: kubernetes-cluster-api Fuzzing Engine: libFuzzer Fuzz Target: fuzzyamlparser Job Type: libfuzzerasankubernetes-cluster-api Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000004d4c40 Crash State: NULL...

kubernetes-cluster-api:fuzz_patch: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5177889601748992 Project: kubernetes-cluster-api Fuzzing Engine: libFuzzer Fuzz Target: fuzzpatch Job Type: libfuzzerasankubernetes-cluster-api Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL...

kubernetes-cluster-api:fuzz_machinedepoyment_controller: Crash in reflect.Value.Elem

Detailed Report: https://oss-fuzz.com/testcase?key=5446753826766848 Project: kubernetes-cluster-api Fuzzing Engine: libFuzzer Fuzz Target: fuzzmachinedepoymentcontroller Job Type: libfuzzerasankubernetes-cluster-api Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000120039d3 Crash...

kubernetes-cluster-api:fuzz_patch: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6726033105879040 Project: kubernetes-cluster-api Fuzzing Engine: libFuzzer Fuzz Target: fuzzpatch Job Type: libfuzzerasankubernetes-cluster-api Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000035284a8d Crash State: NULL Sanitizer:...

kubernetes-cluster-api:fuzz_unmarshal_cluster_status: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5463013975523328 Project: kubernetes-cluster-api Fuzzing Engine: libFuzzer Fuzz Target: fuzzunmarshalclusterstatus Job Type: libfuzzerasankubernetes-cluster-api Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NU...

Open-Xchange (OX) App Suite Multiple Vulnerabilities -03 (Nov 2015)

Open-Xchange OX App Suite is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Open-Xchange Security Advisory 2013-09-10

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 28260 Bug ID Vulnerability type: CWE-16: Configuration, CWE-287: Improper Authentication, CWE-200: Information Exposure Vulnerable version: 7.0.0 to 7.2.2 Vulnerable component: backend default configuration Fixed version...

CVE-2013-5935

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended...

Hardcoded credentials

Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different...

Design/Logic Flaw

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about 1 runtime activity, 2 network configuration, 3 user sessions, 4 the memcache interface, and 5 the REST interface via API calls suc...

CVE-2013-5935

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended...

PT-2013-5874

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions 7.0.x through 7.0.2-rev14 Open-Xchange AppSuite versions 7.2.x through 7.2.2-rev15 Description The issue is related to a hardcoded password for node join operations in the source code. This allows remote attacker...

CVE-2013-5934: Undefined Security Weakness

Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different...