MinIO 安全漏洞

MinIO is an open source object storage server from the US-based MinIO. The product supports building infrastructures for machine learning, analytics, and application data workloads. MinIO has a security vulnerability. An attacker can escalate privileges by exploiting the vulnerability...

PT-2024-9695 · Minio +2 · Minio +2

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2024-12-13T22-19-12Z Description: The issue is related to a privilege escalation vulnerability in the IAM import API of MinIO, which is a high-performance, S3 compatible object store. This vulnerability allows...

Race Condition

Overview minio is a MinIO Python SDK for Amazon S3 Compatible Cloud Storage Affected versions of this package are vulnerable to Race Condition due to improper handling of shared resources in worker threads via the helpers.py function. An attacker can exploit this by initiating multiple asynchrono...

GHSA-R9MQ-3C9R-FMJQ Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Description Path traversal This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the...

CVE-2024-48914

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914

Summary (CVE-2024-48914): Vendure’s asset server plugin allows an attacker to traverse the server filesystem and read arbitrary files, including configs and environment data, due to using the decoded request path directly in path.join (no normalization). A second vector in the same code path can ...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

MinIO Bootstrap Verify Information Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MinIO Bootstrap Verify Information Disclosure', 'Description' = %q MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment...

GO-2022-0261 Authentication bypass issue in the Operator Console in github.com/minio/console

Authentication bypass issue in the Operator Console in github.com/minio/console...

The vulnerability of the MinIO object storage server, related to the exposure of confidential information to unauthorized individuals, allows attackers to disclose confidential information.

The vulnerability of the MinIO object storage server lies in the use of headers to determine whether an object exists on the server at a given time. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...

ROS-20240807-05

A vulnerability in the PostPolicyBucket component of the MinIO object storage server is related to errors in privilege management. privilege management errors. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by sending specially crafted HTTP...

GHSA-XR7Q-JX4M-X55M vulnerabilities

Vulnerabilities for packages: k8sgpt, spegel, cert-manager-cmctl, kubernetes-csi-external-provisioner, kwok, terragrunt, terraform-provider-google, grafana-agent-operator, cilium-cli, kube-rbac-proxy, conftest, ferretdb, k3s, opentelemetry-collector-contrib, spire-server, vcluster, kots, dagger,...

GHSA-XR7Q-JX4M-X55M vulnerabilities

Vulnerabilities for packages: conftest, kwok, melange, ferretdb, spegel, cilium-cli, falcosidekick, kubernetes-csi-driver-hostpath, opentelemetry-collector-contrib, cert-manager-cmctl, external-secrets-fips, temporal, fulcio-fips, trivy, zot, restic, smarter-device-manager, kube-rbac-proxy-fips,...

GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio

Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...

GO-2024-2886 MinIO information disclosure vulnerability in github.com/minio/minio

MinIO information disclosure vulnerability in github.com/minio/minio...

BIT-MINIO-2024-36107 Information disclosure in minio

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...

Sensitive Information Disclosure

github.com/minio/minio/ is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the ability to infer the existence of objects on a server by sending anonymous requests with random object names...

GHSA-95FR-CM4M-Q5P9 MinIO information disclosure vulnerability

Impact If-Modified-Since If-Unmodified-Since Headers when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information such as Last-Modified of the latest...