9637 matches found
CVE-2024-56349
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs...
CVE-2024-56349
CVE-2024-56349 affects JetBrains TeamCity prior to 2024.12. The issue is an improper access control that allows unauthorized users to modify build logs, potentially compromising log integrity. Root cause is insufficient authorization checks on build log modificationacross multiple sources (Red Ha...
CVE-2024-56349
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs...
PT-2024-9846 · Jetbrains · Teamcity
Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to improper access control in JetBrains TeamCity, which allowed unauthorized users to modify build logs. This could potentially impact the integrity of protected...
JetBrains TeamCity 安全漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from an improper access...
CVE-2024-12729
creationtimestamp| type| source ---|---|--- 2024-12-19 21:04:20+00:00| seen| https://infosec.exchange/users/cve/statuses/113681515115617439 2024-12-19 21:15:43+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ldos66bptg2a 2024-12-19 23:10:58+00:00| seen|...
Remote File Orchestrator Extension 安全漏洞
Remote File Orchestrator Extension is an open source remote file orchestrator extension for Keyfactor. It is used to remotely manage various file-based certificate stores and can be easily extended to manage other certificate stores. A security vulnerability exists in Remote File Orchestrator...
The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit
Posted by Seth Jenkins, Google Project Zero This blog post provides a technical analysis of exploit artifacts provided to us by Google's Threat Analysis Group TAG from Amnesty International. Amnesty’s report on these exploits is available here. Thanks to both Amnesty International and Google's...
CVE-2024-11986
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...
CVE-2024-11986
CVE-2024-11986 involves improper input handling of the Host Header in CrushFTP, allowing an unauthenticated attacker to craft input that is stored in web application logs and can execute when an Administrator views the logs. Connected sources identify CrushFTP as the affected product and note the...
CrushFTP 安全漏洞
CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP versions 10.8.2 and 11.2.1 that stems from the presence of incorrect input handling, which could allow an unauthenticated attacker to store payloads in web application logs, resulting in a stored...
PT-2024-17383 · Crushftp · Crushftp
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves improper input handling in the 'Host Header', allowing an unauthenticated attacker to store a payload in web application logs. When a...
CVE-2024-55886
OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...
CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins
OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...
CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins
OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...
CVE-2024-55886
The CVE affects OpenSearch Data Prepper (OpenTelemetry Logs source) where custom GrpcAuthenticationProvider plugins that implement getHttpAuthenticationService() instead of getAuthenticationInterceptor() fail to perform authentication, allowing unauthorized data ingestion. Affected versions: 2.1....
CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins
OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...
Sensitive Information Disclosure
Rancher Manager is vulnerable to sensitive information disclosure. The vulnerability is due to Helm values being stored directly in the Apps Custom Resource Definition and leaking into audit logs when the audit level is set to 2 or above, allowing users with GET access to read sensitive informati...
UBUNTU-CVE-2024-12292
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...
CVE-2024-12292 Insertion of Sensitive Information into Log File in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...