CVE-2024-7128

CVE-2024-7128 — OpenShift Console unauthenticated data exposure is evidenced by multiple sources in the connected documents. The OpenShift console contains endpoints guarded by authHandler() and authHandlerWithUser(), which under the default openShiftAuth provider perform no authentication checks...

The vulnerability of the Bitbucket Credentials Handler component of the Git-based software platform allows a hacker to gain control of a GitLab account associated with a Bitbucket account of another user, provided that Bitbucket is used as an OAuth 2.0 provider in GitLab.

The vulnerability of the Bitbucket Credentials Handler component of the Git-based software platform for collaborative code development on GitLab is related to inadequate access control mechanisms. Exploiting this vulnerability could allow a malicious actor to gain control over a GitLab account...

Mexico’s Largest ERP Provider ClickBalance Exposes 769 Million Records

ClickBalance ERP providers cloud database exposed 769 million records, including API keys and email addresses. Learn how this…...

The vulnerability of the Provider component in the Apache Airflow network programming environment allows a attacker to perform XSS attacks.

The vulnerability of the Provider component in the Apache Airflow network software relates to the lack of security measures for the website structure. Exploiting this vulnerability allows a remote attacker to execute XSS attacks...

CVE-2024-24786 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2024-24786 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-47108 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-47108 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. A patched version of the package is available...

CVE-2023-39325 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-39325 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-45288 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

SUSE-SU-2024:2568-1 Security update for mockito, snakeyaml, testng

This update for mockito, snakeyaml, testng fixes the following issues: mockito was updated to version 5.11.0: - Added bundle manifest to the mockito-core artifact - Mockito 5 is making core changes to ensure compatibility with future JDK versions. - Switch the Default MockMaker to mockito-inline...

BIT-AIRFLOW-2024-39863 Apache Airflow: Potential XSS Vulnerability

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

The vulnerability of the Data Provider UI component of the Oracle Installed Base information storage center in the Oracle E-Business Suite allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the Data Provider UI component of the Oracle Installed Base information storage center in the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to read,...

Link Injection

Apache Airflow is vulnerable to Link Injection. The vulnerability is due to improper validation for urls in the provider list within the file views.py, which allows an authenticated attacker to inject a malicious link when installing a provider...

CVE-2024-38806 - UAA Failure to Remove Shadow User's Access | Cloud Foundry

Severity LOW Vendor CloudFoundry Foundation Versions Affected UAA Release v77.10.0 or below Description Expected behavior: When UAA is configured to proxy to an external OIDC or SAML provider, and when UAA is configured using the UAA group mapping feature to convert the external provider user...

CVE-2024-39863

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

PYSEC-2024-189

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

The vulnerability of Cryptographic Service Provider (CSP) and Key Storage Provider (KSP) services in Windows operating systems allows attackers to circumvent security restrictions.

The vulnerability of Cryptographic Service Provider CSP and Key Storage Provider KSP services in Windows operating systems is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions...

PT-2024-5041 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.9.3 Description: The issue is related to the lack of protection for the web page structure in the Provider component of Apache Airflow, allowing an authenticated attacker to inject a malicious link when...

AT&T Confirms Data Breach Affecting Nearly All Wireless Customers

American telecom service provider AT&T has confirmed that threat actors managed to access data belonging to "nearly all" of its wireless customers as well as customers of mobile virtual network operators MVNOs using AT&T's wireless network. "Threat actors unlawfully accessed an AT&T workspace on ...

CVE-2024-40965

In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clkgetrate during transfer Instead of repeatedly calling clkgetrate for each transfer, lock the clock rate and cache the value. A deadlock has been observed while adding tlv320aic32x4 audio codec to the...