kernel: af_unix: Fix garbage collector racing against connect()

A flaw was found in the Linux kernel, where the management of inter-process communication uses AFUNIX sockets. The issue arises from a race condition where a partially initialized socket with specific permissions carrying SCMRIGHTS is improperly handled during garbage collection. This situation...

CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity. This allows someone with access to the logs t...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of measures taken at the administrative level for data cleansing. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with system privileges...

SINEMA Remote Connect Client Remote Access

The vulnerability of the SINEMA Remote Connect client web interface is related to security mechanism errors. Exploiting this vulnerability allows a malicious actor to view and edit protected configuration information about device settings without proper access rights...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of data cleansing measures at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of measures taken at the management level for data cleansing. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with system privileges...

SINEMA Remote Connect VPN Privilege Escalation

The vulnerability of the SINEMA Remote Connect VPN service relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to create a user with administrator privileges...

SINEMA Remote Connect Client Remote Access Disclosure

The vulnerability of the SINEMA Remote Connect client web interface is related to security mechanism errors. Exploiting this vulnerability allows an attacker to remotely view and edit protected information regarding VxLAN network configurations without proper access rights...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of measures taken at the administrative level for data cleansing. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with system privileges...

SINEMA Remote Connect VPN Code Execution

The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of data cleansing measures at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js (CVE-2024-35255, CVE-2024-37168)

Summary IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-655)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-655 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann...

Security Bulletin: IBM App Connect Enterprise Certified Container Operations Dashboard is vulnerable to denial of service [CVE-2024-36129]

Summary OpenTelemetry is used by IBM App Connect Enterprise Certified Container for the Operations Dashboard. IBM App Connect Enterprise Certified Container Operations Dashboard is vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

SolarWinds Access Rights Manager Connect Code Execution

The vulnerability of the Connect method in the SolarWinds Access Rights Manager software lies in improper restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution

Summary Salesforce tough-cookie is used by IBM App Connect Enterprise Certified Container for handling cookies. IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported vulnerability in...