OPENSUSE-SU-2024:12410-1 dex-oidc-2.35.3-1.1 on GA media

These are all security issues fixed in the dex-oidc-2.35.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10714-1 dex-oidc-2.28.1-1.3 on GA media

These are all security issues fixed in the dex-oidc-2.28.1-1.3 package on the GA media of openSUSE Tumbleweed...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner-fips, overmind, k8sgpt, mongo-tools, kubewatch, gostatsd, hcloud, aws-load-balancer-controller-fips, wave-fips, ksops, hello-world-golang, opa, mc, eksctl, kubebuilder, go-licenses, rabbitmq-default-user-credential-updater, chartmuseum...

Dexalot Announces Launch of Its Central Limit Order Book DEX on Arbitrum

By Owais Sultan Central limit order book CLOB decentralized exchange Dexalot has announced it is launching on Arbitrum. The move marks… This is a post from HackRead.com Read the original post: Dexalot Announces Launch of Its Central Limit Order Book DEX on Arbitrum...

CVE-2024-32653 Insufficient input filtering of "package name" allows command execution in the device with shell privileges

jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for...

Raindex Launches On Flare To Power Decentralized CEX-Style Trading

By Owais Sultan Flare, the blockchain for data, has announced the launch of the Raindex desktop app: a new intents-like DEX… This is a post from HackRead.com Read the original post: Raindex Launches On Flare To Power Decentralized CEX-Style Trading...

IdeaSoft To Launch an Innovative Perpetual DEX on INTMAX’s Open-source L2 Plasma Next

By Uzair Amir Building on Plasma Next would make the DEX as convenient as CEX for trading with low fees, slippage, and waiting period. This is a post from HackRead.com Read the original post: IdeaSoft To Launch an Innovative Perpetual DEX on INTMAX’s Open-source L2 Plasma Next...

CVE-2024-2465

Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: ko, rook, cloudflared, timestamp-authority, caddy, sops, vexctl, zot, skaffold, fulcio, tkn, wolfictl, falcoctl, bank-vaults, minio, gomplate, zarf, sigstore-scaffolding, flux-kustomize-controller, temporal-ui-server, weaviate, dex, frp, cosign, argo-workflows, kargo...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: zarf, temporal-fips, kube-rbac-proxy-fips, rook, timestamp-authority-fips, caddy-fips, kubernetes-dashboard-fips, rekor, weaviate, sigstore-scaffolding, fulcio, zot, kube-oidc-proxy, temporal-ui-server, dex, rancher-agent, falcoctl-fips, kubernetes-dashboard, tkn,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner-fips, nodetaint, up, doppler-kubernetes-operator, crossplane-provider-aws-sns, kube-rbac-proxy-fips, hubble, chartmuseum, supercronic, cluster-proportional-autoscaler, prometheus-statsd-exporter, kyverno-policy-reporter-ui,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner-fips, nodetaint, up, doppler-kubernetes-operator, crossplane-provider-aws-sns, kube-rbac-proxy-fips, hubble, chartmuseum, supercronic, cluster-proportional-autoscaler, prometheus-statsd-exporter, kyverno-policy-reporter-ui,...

GHSA-GR79-9V6V-GC9R vulnerabilities

Vulnerabilities for packages: dex...

Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...

GHSA-GR79-9V6V-GC9R Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...

GHSA-GR79-9V6V-GC9R vulnerabilities

Vulnerabilities for packages: dex...

CVE-2024-23656

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656 vulnerabilities

Vulnerabilities for packages: dex...

CVE-2024-23656 vulnerabilities

Vulnerabilities for packages: dex...

Authentication flaw

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...