Fedora: Security Advisory for dogtag-pki (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: dogtag-pki-11.5.0-3.fc40

Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. Dogtag PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token...

Securing the Next Level: Automated Cloud Defense in Game Development with InsightCloudSec

Imagine the following scenario: You're about to enjoy a strategic duel on chess.com or dive into an intense battle in Fortnite, but as you log in, you find your hard-earned achievements, ranks, and reputation have vanished into thin air. This is not just a hypothetical scenario but a real...

The 3 most common post-compromise tactics on network infrastructure

Weve been discussing networking devices quite a lot recently and how Advanced Persistent Threat actors APTs are using highly sophisticated tactics to target aging infrastructure for espionage purposes. Some of these attacks are also likely prepositioning the APTs for future disruptive or...

Ex-Google Engineer Arrested for Stealing AI Technology Secrets for China

The U.S. Department of Justice DoJ announced the indictment of a 38-year-old Chinese national and a California resident for allegedly stealing proprietary information from Google while covertly working for two China-based tech companies. Linwei Ding aka Leon Ding, a former Google engineer who was...

kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c

A flaw was found in the Linux kernel Direct Rendering Infrastructure DRI subsystem in which a use-after-free can be caused when a user triggers a race condition between a nonblocking atomic commit and a driver unload. A local user could use this flaw to crash the system or potentially escalate...

BIT-TENSORFLOW-2022-23593 Segfault in `simplifyBroadcast` in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector...

BIT-PARSE-2021-39187 Crash server with query parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

BIT-PARSE-2022-31089 Invalid file request can crashe parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability...

BIT-PARSE-2022-31112 Protected fields exposed via LiveQuery in parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client respons...

BIT-PARSE-2022-41879 Parse Server subject to Prototype pollution via Cloud Code Webhooks

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server...

BIT-PARSE-2023-46119 Parse Server may crash when uploading file without extension

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1...

BIT-MYSQL-SHELL-2022-21535

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell: General/Core Client. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Shell executes to compromise...

BIT-MYSQL-SHELL-2022-21555

Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL component: Shell: GUI. Supported versions that are affected are 1.1.8 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Shell for VS Code executes to...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, cfssl, gomplate, kine, falcosidekick, tflint, pgpool2exporter, protoc-gen-go-grpc, temporal-server, bank-vaults, boring-registry, golangci-lint, newrelic-nri-kube-events, kaf, k8sgpt, skaffold, cadvisor, helm-operator, ip-masq-agent, zot,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: yq, cfssl, docker-credential-ecr-login, gomplate, kine, tflint, oras, protoc-gen-go-grpc, temporal-server, golangci-lint, kaf, k8sgpt, skaffold, kube-rbac-proxy, aws-flb-firehose, nri-nagios, cadvisor, helm-operator, ip-masq-agent, nri-redis, nri-apache, tailscale,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: yq, cfssl, docker-credential-ecr-login, gomplate, kine, tflint, oras, protoc-gen-go-grpc, temporal-server, golangci-lint, kaf, k8sgpt, skaffold, kube-rbac-proxy, aws-flb-firehose, nri-nagios, cadvisor, helm-operator, ip-masq-agent, nri-redis, nri-apache, tailscale,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: yq, cfssl, docker-credential-ecr-login, gomplate, kine, tflint, oras, protoc-gen-go-grpc, temporal-server, golangci-lint, kaf, k8sgpt, skaffold, kube-rbac-proxy, aws-flb-firehose, nri-nagios, cadvisor, helm-operator, ip-masq-agent, nri-redis, nri-apache, tailscale,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: yq, cfssl, docker-credential-ecr-login, gomplate, kine, tflint, oras, protoc-gen-go-grpc, temporal-server, golangci-lint, kaf, k8sgpt, skaffold, kube-rbac-proxy, aws-flb-firehose, nri-nagios, cadvisor, helm-operator, ip-masq-agent, nri-redis, nri-apache, tailscale,...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 3 (6.0.1-89)

This update provides stability improvements. Vulnerability id: VSTOR-82695 Deploying a Kubernetes cluster may take longer than expected. Vulnerability id: VSTOR-82730 Restarting libvirtd causes EFI VMs to reboot...