LiteLLM Code Injection Vulnerability

LiteLLM is a LiteLLM open source application. All LLM APIs can be called using the OpenAI format. A code injection vulnerability exists in LiteLLM v1.35.8, which stems from the fact that the adddeployment function assigns base64 decoding and decryption environment variables to os.environ, which c...

RHEL 8 / 9 : Red Hat Ceph Storage 5.3 (RHSA-2024:4118)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4118 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...

MAL-2024-6735 Malicious code in aws-blue_green_deploy (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

org.keycloak:keycloak-dependencies-server-all (20.0.4), org.keycloak:keycloak-guides (20.0.4) +5 more potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (20.0.4)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 20.0.4 - org.keycloak:keycloak-guides...

org.keycloak:keycloak-dependencies-server-all (20.0.0), org.keycloak:keycloak-guides (20.0.0) +6 more potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (20.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 20.0.0 - org.keycloak:keycloak-guides...

GenAI risks to be aware of — and prepare for — according to Gartner®

The deployment of GenAI, LLMs, and chat interfaces expands potential attack surfaces and poses increased security threats...

JetBrains YouTrack security vulnerabilities

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...

Malvertising Campaign Leads to Execution of Oyster Backdoor

The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...

CVE-2024-35328

A flaw was found in the libyaml library. Setting a YAML string with the yamlparsersetinputstring function to be parsed by the yamlparserparse function can cause an infinite loop, resulting in a denial of service in the application linked to the library. Mitigation Applications that do not parse...

CVE-2024-37293

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

CVE-2024-37293 aws-deployment-framework's potential risk can lead to privilege escalation

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

CVE-2024-37293

The CVE concerns the AWS Deployment Framework (ADF) bootstrap process. Prior to v4.0.0, the bootstrap CodeBuild role could call sts:AssumeRole without restrictions, enabling escalation to any AWS account in the organization with elevated privileges. Patches are included in aws-deployment-framewor...

CVE-2024-37293

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

CVE-2024-37293 aws-deployment-framework's potential risk can lead to privilege escalation

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

CVE-2024-37293 aws-deployment-framework's potential risk can lead to privilege escalation

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability in...

Description of the security update for SharePoint Server Subscription Edition: June 11, 2024 (KB5002603)

None None...

Description of the security update for Office 2016: June 11, 2024 (KB5002575)

None None...

PT-2024-27450 · Amazon · Aws-Deployment-Framework

Name of the Vulnerable Software and Affected Versions: aws-deployment-framework versions prior to 4.0.0 Description: The AWS Deployment Framework ADF contains a bootstrap process that relies on elevated privileges to deploy ADF's bootstrap stacks, facilitating multi-account cross-region...

Siemens SINEC Traffic Analyzer security vulnerabilities

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communication between controllers and IO devices. The software detects PROFINET communication problems and reports them to the user via Web-UI. Siemens SINEC Traffic Analyzer suffers from a Credential Protection...