624 matches found
Raindex Launches On Flare To Power Decentralized CEX-Style Trading
By Owais Sultan Flare, the blockchain for data, has announced the launch of the Raindex desktop app: a new intents-like DEX… This is a post from HackRead.com Read the original post: Raindex Launches On Flare To Power Decentralized CEX-Style Trading...
IdeaSoft To Launch an Innovative Perpetual DEX on INTMAX’s Open-source L2 Plasma Next
By Uzair Amir Building on Plasma Next would make the DEX as convenient as CEX for trading with low fees, slippage, and waiting period. This is a post from HackRead.com Read the original post: IdeaSoft To Launch an Innovative Perpetual DEX on INTMAX’s Open-source L2 Plasma Next...
CVE-2024-2465
Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, kots, melange, temporal-ui-server, cosign, frp, ko, skaffold, zot, tkn, kube-rbac-proxy, slsa-verifier, caddy, guac, sigstore-scaffolding, rabbitmq-messaging-topology-operator, kargo, rook, spire-server, sops, zarf, apko, policy-controller,...
GHSA-C5Q2-7R4C-MV6G vulnerabilities
Vulnerabilities for packages: spire-server-fips, minio-fips, oauth2-proxy, sigstore-scaffolding-fips, gomplate-fips, step, dgraph, external-secrets-fips, rabbitmq-messaging-topology-operator, rancher-agent, weaviate, policy-controller, dex-fips, kube-rbac-proxy, temporal, ko, vault-csi-provider,...
GHSA-8R3F-844C-MC37 vulnerabilities
Vulnerabilities for packages: doppler-kubernetes-operator, mc-fips, minio-fips, k3d, kubernetes-csi-external-resizer, crossplane, crossplane-provider-aws-iam, kubeflow, prometheus-alertmanager, kyverno-policy-reporter, rabbitmq-messaging-topology-operator, newrelic-infrastructure-agent, temporal,...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: doppler-kubernetes-operator, mc-fips, minio-fips, k3d, kubernetes-csi-external-resizer, crossplane, crossplane-provider-aws-iam, kubeflow, prometheus-alertmanager, kyverno-policy-reporter, rabbitmq-messaging-topology-operator, newrelic-infrastructure-agent, temporal,...
GHSA-GR79-9V6V-GC9R Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...
GHSA-GR79-9V6V-GC9R vulnerabilities
Vulnerabilities for packages: dex...
GHSA-GR79-9V6V-GC9R vulnerabilities
Vulnerabilities for packages: dex...
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...
CVE-2024-23656
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...
CVE-2024-23656 vulnerabilities
Vulnerabilities for packages: dex...
CVE-2024-23656 vulnerabilities
Vulnerabilities for packages: dex...
Authentication flaw
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...
CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...
CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...
CVE-2024-23656
Dex 2.37.0 serves HTTPS with TLS 1.0/1.1 and non-respected cipher suites because tlsConfig is ignored after the TLS cert reloader; minimum TLS version hardening is ineffective. This can allow eavesdropping on TLS 1.0/1.1 traffic. The issue is fixed in Dex 2.38.0.
dex Security Vulnerabilities
dex is an identity service that uses OpenID Connect to drive authentication for other applications. A security vulnerability exists in versions of dex prior to 2.38.0 that stems from the use of insecure TLS 1.0 and TLS 1.1 to provide HTTPS, which can be exploited by an attacker to decrypt TLS 1.0...