CVE-2024-4211

CVE-2024-4211 affects OpenText Application Automation Tools (v24.1.0 and below). Root cause: improper validation of input quantity coupled with multiple missing permission checks in ALM job configuration. Impact: users with Overall/Read permission could enumerate ALM server names, usernames and c...

CVE-2024-22034 Crafted projects can overwrite special files in the .osc config directory

Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...

CVE-2024-22034 Crafted projects can overwrite special files in the .osc config directory

Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...

CVE-2024-22032 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members for projects...

Malicious code in region-config-resolver (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9798 Malicious code in region-config-resolver (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in eventstream-serde-config-resolver (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9604 Malicious code in eventstream-serde-config-resolver (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9566 Malicious code in config.env-replace (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in config.env-replace (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in config-conventional (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9db287fbaa3f09a3e8e30d18616b161cbc82f46c0867a4f8638067c82846d154 The OpenSSF Package Analysis project identified 'config-conventional' @ 20.1.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-9565 Malicious code in config-conventional (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9db287fbaa3f09a3e8e30d18616b161cbc82f46c0867a4f8638067c82846d154 The OpenSSF Package Analysis project identified 'config-conventional' @ 20.1.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-9478 Malicious code in @usaa-grp-inf-presentation/browserslist-config-usaa (npm)

--- -= Per source details. Do not edit below this line.=-...

ABB Cylon Aspect 3.08.01 (mapConfigurationDownload.php) Config Download

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an unauthenticated...

Apache Solr 安全漏洞

Apache Solr is the United States Apache Apache Foundation of a search server based on Lucene a full-text search engine. The product supports level search , vertical search , highlighting search results and so on. A code issue vulnerability exists in Apache Solr, which stems from the presence of a...

MAL-2024-12303 Malicious code in maliciouspackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

CVE-2024-45273

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used...

CVE-2024-45271

An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation...

CVE-2024-45271

An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation...

CVE-2024-45273

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used...