Connaisseur 安全漏洞

Connaisseur is an open source access controller from Secure Systems Engineering that integrates container image signature verification into Kubernetes clusters. A security vulnerability exists in Connaisseur version 3.3.0 and prior versions, which stems from an incorrect operation that can lead t...

CBL Mariner 2.0 Security Update: python-pygments (CVE-2021-27291)

The version of python-pygments installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-27291 advisory. - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on...

ROS-20240827-14

A vulnerability in the Pydantic data validation library involves the use of regular expressions. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications stems from the inefficient complexity of regular expressions. This allows attackers to trigger a service failure.

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications is related to excessive reverse tracking when attempting to sanitize certain SVG attributes. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Denial Of Service (DoS)

org.springframework, spring-expression is vulnerable to a Denial of Service DoS. The vulnerability is due to the evaluation of user-supplied Spring Expression Language SpEL expressions, which attackers can exploit by providing specially crafted expressions that can overload the system...

UBUNTU-CVE-2024-38808

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Specifically, an application is vulnerable when the following is true:...

Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of authorization logic with 'but not' and 'from' expressions and a userset, allowing an attacker to bypass authorization checks and gain unauthorized access to resources...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to uncontrolled resource consumption, allows a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an uncontrolled resource consumption caused by the use of regular expressions in handling invalid commits. Exploiting this vulnerability can allow a malicious actor to cause service...

DataGear 安全漏洞

DataGear is an open source, free data visualization and analysis platform from DataGear, Inc. A security vulnerability exists in DataGear version 5.0.0 and earlier versions, which originates in the function evaluationVariableExpression in the file ConversionSqlParamValueMapper.java that causes...

CVE-2024-42350

Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be...

CVE-2024-42350

The CVE describes a public-key confusion in Biscuit’s third-party blocks: a forged ThirdPartyBlock request can cause a third-party authority to generate datalog trusting the wrong keypair, enabling an attacker to embed a trusted annotation in tokens. The issue arises from how the block request co...

CVE-2024-42350 Public key confusion in third party block in Biscuit

Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be...

CVE-2024-42350 Public key confusion in third party block in Biscuit

Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be...

The vulnerability of the ignoreDifferences configuration in the declarative delivery tool for GitOps for Kubernetes Argo CD allows a attacker to trigger a service failure.

The vulnerability of the ignoreDifferences configuration option in GitOps’ continuous delivery tool for Kubernetes Argo CD is related to an uncontrolled resource consumption when processing the jqPathExpressions parameter. Exploiting this vulnerability could allow a malicious actor to cause servi...

OSGeo GeoServer RCE (CVE-2024-36401)

The version of OSGeo GeoServer installed on the remote host is affected by a remote code executionvulnerability, as follows: - Multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer installation due to...

CVE-2024-41948 biscuit-java vulnerable to public key confusion in third party block

biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

GHSA-P9W4-585H-G3C7 biscuit-auth vulnerable to public key confusion in third party block

Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of the previous block used in the signature - t...

biscuit-auth vulnerable to public key confusion in third party block

Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of the previous block used in the signature - t...