Malicious plugin names, recipients, or identities can cause arbitrary binary execution

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or an attacker-controlled plugin name via the -j flag. On UNIX systems, a directory...

Azure Service Connector Privilege Escalation

The vulnerability of the Command Line Interface CLI of the Azure Service Connector relates to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

GitHub CLI Command Path Restriction

The vulnerability of the CLI command-line interface of the GitHub collaborative development platform relates to incorrect path name restrictions for restricted directories when processing the artifact name and the --dir flag. Exploiting this vulnerability may allow a malicious actor to gain read,...

Exploit for Path Traversal in Grafana

Automated Exploit Tool for Grafana CVE-2021-43798 !Previewi...

CVE-2024-31891

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command line access to the 'scalemgmt' user can elevate privileges to gain root access to the host operating system...

CVE-2024-31891

IBM Storage Scale GUI 5.1.9.0–5.1.9.6 and 5.2.0.0–5.2.1.1 contain a local privilege escalation vulnerability. A user with command line access to the scalemgmt account can elevate privileges to root on the host OS. Affected versions include 5.1.9.x and 5.2.x prior to fixes. Remediation: upgrade to...

CVE-2024-31891 IBM Storage Scale privilege escalation

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command line access to the 'scalemgmt' user can elevate privileges to gain root access to the host operating system...

Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

...

GNU objdump Buffer Overflow Vulnerability

GNU objdump is a command-line program from the American GNU community for displaying various information about target files on Unix-like operating systems. A buffer overflow vulnerability exists in GNU objdump, which stems from the failure to properly validate the length of input data in the BFD...

CVE-2024-55888 Content Security Policy appears to be missing in software and production setup

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

CVE-2024-55888 Content Security Policy appears to be missing in software and production setup

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

CVE-2024-55888 Content Security Policy appears to be missing in software and production setup

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

CVE-2024-55888

CVE-2024-55888 affects Hush Line, an open-source whistleblower management system. A production-server misconfiguration in versions 0.1.0 through 0.3.4 left out a Content Security Policy and security headers, potentially bypassing XSS filters. The issue was fixed in version 0.3.5. Affected: Hush L...

CVE-2024-55888

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

CLSA-2024-1734006823 php: Fix of CVE-2024-11234

CVE-2024-11234: Fix possibility of HTTP request smuggling in configured proxy URI by prohibiting CRLF injection...

Moderate: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

AZL-54327 CVE-2024-45337 affecting package cf-cli for versions less than 8.7.3-4

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

CVE-2024-55888: Improper Restriction of Rendered UI Layers or Frames

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

Hush Line security vulnerabilities

Hush Line is a free open source anonymous tip line service from Science & Design Open Source. A security vulnerability exists in Hush Line version 0.1.0 through versions prior to 0.3.5, which stems from a production server misconfiguration that does not provide any content security policy or...

PT-2024-36602 · Hush Line · Hush Line

Name of the Vulnerable Software and Affected Versions: Hush Line versions 0.1.0 through 0.3.4 Description: Hush Line is an open-source whistleblower management system. The production server was misconfigured, missing content security policy and security headers, which could result in bypassing of...