org.keycloak:keycloak-saml-wildfly-subsystem (>=1.7.0.cr1, <=1.7.0.final), org.keycloak:keycloak-wildfly-server-subsystem (>=1.7.0.cr1, <=1.7.0.final) +32 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (1.0.2.final)

org.wildfly.core:wildfly-server MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.keycloak:keycloak-saml-wildfly-subsystem =1.7.0.cr1, =1.7.0.cr1, =1.7.0.cr1, =3.2.0,...

org.wildfly.core:wildfly-deployment-scanner (1.0.0.cr7), org.wildfly.core:wildfly-embedded (1.0.0.cr7) +6 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (1.0.0.cr7)

org.wildfly.core:wildfly-server MAVEN version 1.0.0.cr7 is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.wildfly.core:wildfly-deployment-scanner 1.0.0.cr7 - org.wildfly.core:wildfly-embedded...

Clickjacking Vulnerability in JP1/ServerConductor/Deployment Manager

Overview A Clickjacking Vulnerability was found in JP1/ServerConductor/Deployment Manager. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

Security Bulletin: IBM SPSS Collaboration and Deployment Services is vulnerable to server-side request forgery (CVE-2024-22329)

Summary IBM WebSphere Application Server Liberty that is embedded in IBM SPSS Collaboration and Deployment Services is vulnerable to server-side request forgery Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: IBM SPSS Collaboration and Deployment Services is vulnerable to a denial of service attack originating in IBM WebSphere Application Server Liberty (CVE-2024-25026)

Summary IBM WebSphere Application Server Liberty that is embedded in IBM SPSS Collaboration and Deployment Services is vulnerable to a denial of service. This vulnerability is addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Product...

Security Bulletin: BM SPSS Collaboration and Deployment Services is vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

Summary IBM WebSphere Application Server Liberty that is embedded in IBM SPSS Collaboration and Deployment Services is vulnerable to an XML External Entity XXE injection vulnerability Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products a...

openjdk: Enhance array handling (Oracle CPU 2025-01)

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be...

JetBrains YouTrack 日志信息泄露漏洞

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from a log information disclosure vulnerability that stems from the fact that persistent tokens can be exposed in logs. An attacker can exploit this...

Description of the security update for SharePoint Server 2019: January 14, 2025 (KB5002666)

None None...

Description of the security update for Office 2016: January 14, 2025 (KB5002595)

None None...

Malicious code in marked-ps (npm)

This package deploys Windows gh0strat malware via VBScript. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33f4820622bde56fc1bf9394cd1a6d5af92c7099d9fc2ed247a512cfc480372 Any computer that has this package installed or running should be considered fully compromise...

ZenML < 0.56.3 Unpatched Session Expiration Exposure (CVE-2024-4680)

The version of ZenML installed on the remote host is prior to 0.56.3. It is, therefore, affected by a vulnerability which allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change,...

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation

Cybersecurity researchers have uncovered three security weaknesses in Microsoft's Azure Data Factory Apache Airflow integration that, if successfully exploited, could have allowed an attacker to gain the ability to conduct various covert actions, including data exfiltration and malware deployment...

TrueWinter simofa 访问控制错误漏洞

TrueWinter simofa is a tool from TrueWinter to help automate the building and deployment of static websites. An access control error vulnerability exists in versions of TrueWinter simofa prior to 0.2.7 that stems from a design error in the RouteLoader class, where some API routes may be publicly...

CVE-2024-56799: Missing Authentication for Critical Function

Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication. This vulnerability has been patched in v0.2.7...

JetBrains TeamCity Disclosure

The vulnerability of the Continuous Integration and Deployment application delivery system CI/CD of TeamCity in JetBrains is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Splunk Secure Gateway Registration Method Sensitive Data Protection

The vulnerability of the mobile device registration and mobile application deployment mechanism of Splunk Secure Gateway, a platform for operational analytics in Splunk Enterprise, is related to insufficient protection of sensitive data due to improper access control to the KV Store Key Value...

PT-2024-40113 · Red Hat · Wildfly Management Console

Name of the Vulnerable Software and Affected Versions: WildFly management console affected versions not specified Description: A cross-site scripting issue was found in the WildFly management console, specifically in the deployment system, allowing a user to perform cross-site scripting. This cou...

Open Cluster Management vulnerable to Trust Boundary Violation

A flaw was found in Open Cluster Management OCM when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named...

Citrix Endpoint Management (aka XenMobile Server) 10.16.0 Rolling Patch 4

Package name: xms10.16.0.10427.bin For: XenMobile Server 10.16.0 Deployment type: On-premises only Replaces: xms10.16.0.10318.bin, xms10.16.0.10205.bin, xms10.16.0.10108.bin Date: December 2024 Languages supported: English US Important notes about this update As a best practice, Citrix recommends...