8599 matches found
CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity expiry, not-before, issuance date, which can allow an attacker to bypass the check for token expiration. The issue requires to have ...
CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity expiry, not-before, issuance date, which can allow an attacker to bypass the check for token expiration. The issue requires to have ...
CVE-2024-8642
CVE-2024-8642 affects Eclipse Dataspace Components: versions 0.5.0 up to before 0.9.0 suffer from a missing token validity check in ConsumerPullTransferTokenValidationApiController (expiry, not-before, issuance date). This can enable bypass of token expiration protections when a dataplane is conf...
CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity expiry, not-before, issuance date, which can allow an attacker to bypass the check for token expiration. The issue requires to have ...
CVE-2024-40662
In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Eclipse Dataspace Components 安全漏洞
Eclipse Dataspace Components is a development connector for Eclipse Dataspace Components open source. A security vulnerability exists in Eclipse Dataspace Components version 0.5.0 through versions prior to 0.9.0 that stems from not checking for token validity, which could allow an attacker to...
PT-2024-7968 · Eclipse · Eclipse Dataspace Components
Name of the Vulnerable Software and Affected Versions: Eclipse Dataspace Components versions 0.5.0 through 0.9.0 Description: The issue is related to the ConsumerPullTransferTokenValidationApiController component, which has inadequate authentication procedures. This allows a remote attacker to...
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, access sensitive data and potentially execute commands with Administrator privileges. Abuse is not easy and requires prior authentication a...
CVE-2024-43458
Windows Networking Information Disclosure Vulnerability...
VulnCheck KEV: CVE-2024-43491
Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 initial version released July 2015. This means that an attacker could exploit these previously mitigated vulnerabilities...
PT-2024-6050 · Microsoft · Windows 10 +1
Name of the Vulnerable Software and Affected Versions: Windows 10 version 1507 Description: The vulnerability is related to a servicing stack issue that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507. This means that an attacker could...
CVE-2024-34156 vulnerabilities
Vulnerabilities for packages: newrelic-prometheus-configurator, scorecard, victoriametrics-operator-fips, s5cmd, vertical-pod-autoscaler, nvidia-nsight-compute-12.9, eck-operator-fips, rabbitmq-default-user-credential-updater, go-licenses, dockerize, speedtest-go, regclient,...
CVE-2024-34158 vulnerabilities
Vulnerabilities for packages: newrelic-prometheus-configurator, scorecard, victoriametrics-operator-fips, s5cmd, vertical-pod-autoscaler, nvidia-nsight-compute-12.9, eck-operator-fips, rabbitmq-default-user-credential-updater, go-licenses, dockerize, speedtest-go, regclient,...
CVE-2024-34155 vulnerabilities
Vulnerabilities for packages: newrelic-prometheus-configurator, scorecard, victoriametrics-operator-fips, s5cmd, vertical-pod-autoscaler, nvidia-nsight-compute-12.9, eck-operator-fips, rabbitmq-default-user-credential-updater, go-licenses, dockerize, speedtest-go, regclient,...
ROS-20240906-02
Vulnerability of the kmemcachedestroy function of the lib/listdebug.c library of the Linux kernel is related to a buffer overrun. is related to an operation exceeding the buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2024-39338, CVE-2024-4068, CVE-2021-23727)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. The update addresses these issues. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw...
Debian dla-3870 : python-oslo.utils-doc - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3870 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3870-1 [email protected] https://www.debian.org/lts/security/...
[SECURITY] [DLA 3871-1] cinder security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3871-1 [email protected] https://www.debian.org/lts/security/ Thomas Goirand September 05, 2024 https://wiki.debian.org/LTS -...
[SECURITY] [DLA 3870-1] python-oslo.utils new upstream release
------------------------------------------------------------------------- Debian LTS Advisory DLA-3870-1 [email protected] https://www.debian.org/lts/security/ Thomas Goirand September 05, 2024 https://wiki.debian.org/LTS -...