CVE-2024-8097: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server Logging modules allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 befo...

PT-2024-38801

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.2.191.0 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 5.2020.2 through 5.2022.5 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

org.keycloak:keycloak-adapter-core (4.7.0.final), org.keycloak:keycloak-admin-client (4.7.0.final) +63 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (4.7.0.final)

org.keycloak:keycloak-core MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 4.7.0.final - org.keycloak:keycloak-admin-client 4.7.0.final -...

org.fintrace:microservice-keycloak-support (>=0.0.4, <=0.0.9), org.keycloak:keycloak-adapter-core (4.0.0.beta3) +64 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (4.0.0.beta3)

org.keycloak:keycloak-core MAVEN version 4.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.fintrace:microservice-keycloak-support =0.0.4, =0.0.9 - org.keycloak:keycloak-adapter-core...

edu.byu.hbll.maven:application-parent (>=3.0.0, <=3.4.0), org.keycloak:keycloak-adapter-core (4.8.2.final) +64 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (4.8.2.final)

org.keycloak:keycloak-core MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - edu.byu.hbll.maven:application-parent =3.0.0, =3.4.0 - org.keycloak:keycloak-adapter-core 4.8.2.final...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

io.quarkus:quarkus-keycloak (>=0.14.0, <=0.15.0), io.quarkus:quarkus-keycloak-deployment (>=0.14.0, <=0.15.0) +67 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (6.0.0)

org.keycloak:keycloak-core MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.quarkus:quarkus-keycloak =0.14.0, =0.14.0, =1.9.0, =1.9.0, =1.9.4 - org.keycloak:keycloak-adapter-core...

com.github.bogad:itarone-keycloak-starter (>=2.0.0, <=2.1.2), de.samply:auth-client (4.0.1) +65 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (4.0.0.final)

org.keycloak:keycloak-core MAVEN version 4.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.bogad:itarone-keycloak-starter =2.0.0, =2.1.2 - de.samply:auth-client 4.0.1 -...

MAL-2024-8836 Malicious code in @warnermediacode/wme-gep-modules-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a4a72f149d9eb6781982bac5c0c9283126ceab07ead60b9298ffb1c9f889ca8a The OpenSSF Package Analysis project identified '@warnermediacode/wme-gep-modules-bundle' @ 99.50.55 npm as malicious. It is considered maliciou...

DEBIAN-CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

UBUNTU-CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2023-39333: Improper Control of Generation of Code

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2024-2166

CVE-2024-2166 affects Forcepoint Email Security (Real Time Monitor modules). Root cause: improper neutralization of input during web page generation, leading to a reflected cross-site scripting (XSS) vulnerability. Affected product version: Email Security prior to 8.5.5 HF003. CVSS details from N...

ZZCMS Cross-Site Scripting Vulnerabilities

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v.2023 and prior versions, which stems from a phpinfo function that discloses detailed information about the PHP environment, including server configuration, loaded modules, a...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119

OpenSSL CVE-2024-6119 causes a denial of service when applications perform certificate name checks (e.g., TLS server name validation). The issue stems from reading an invalid memory address during name comparison (e.g., otherName in X.509) and may terminate the process. Multiple connected advisor...

CVE-2024-6119

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...