CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3

CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3. A patched version of the package is available...

CVE-2023-40132

In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

CVE-2023-40132

CVE-2023-40132 affects Google Android through RingtoneManager.setActualDefaultRingtoneUri. The vulnerability arises from a missing permission check when accessing content providers, allowing a local escalation of privilege by bypassing read permissions. Impact is described as local privilege esca...

Google Android 安全漏洞

Google Android is a Linux-based operating system from the American company Google. Google Android suffers from an elevation of privilege vulnerability that stems from a lack of privilege checking and can be exploited to bypass the read permission of a content provider. An attacker can exploit the...

AZL-78537 CVE-2024-13176 affecting package openssl-fips-provider 3.1.2-1

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...

Malicious code in @moneyguide-devkit/style-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d41e363cb9b67e73c6cfe2f5b71641d9289a57d80051c4e3e67b22db36574d8 The OpenSSF Package Analysis project identified '@moneyguide-devkit/style-provider' @ 1.0.1 npm as malicious. It is considered malicious because...

CVE-2018-9375

In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9375

In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

CVE-2025-23206

The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

zot 安全漏洞

zot is an OCI image registry open-sourced by The zot Project. A security vulnerability exists in versions prior to zot 2.1.2, which stems from a conflict in the configuration file, where any authorized zot configuration that relies on group-based authorization does not honor group...

PT-2025-4847 · Boltdb +2 · Boltdb +2

Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.2 Description: The issue arises from the way group data is stored for users in the boltdb database, specifically as an append-list. This leads to group revocations or removals being ignored in the API. When a user lo...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the SAML SSO implementation process which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Note: This is...

be.jidoka:jdk-keycloak-admin (>=2.0.0 <=2.2.0), cn.sparrowmini:sparrow-keycloak-adapter (>=0.0.1 <=0.0.2) +279 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (>=4.0.0.Beta1 <=4.7.7.Final)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version =4.0.0.Beta1, =2.0.0, =0.0.1, =0.5.8, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =1.7.0, =19.0.0, =2.1.0, =2.6.0 and more Source cves: CVE-2023-0482 Source advisory: OSV:GHSA-2C6G-PFX...

com.arxcess360:file-server-sdk (>=1.0 <=1.0.4), com.axelor:axelor-web (>=8.0.0 <=8.2.1) +255 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (>=6.0.0.Beta1 <=6.2.2.Final)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version =6.0.0.Beta1, =1.0, =8.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =4.1.1, =1.0a17, =0.3.48, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.0.0-test, =0.0.0-test, =13.32.0.RELEASE and more Source cves: CVE-2023-0482 Source advisory...

com.planonsoftware.app:com.planonsoftware.app.gradle.plugin (=0.0.1), com.planonsoftware:gradle.development.environment.plugin (=0.0.1) +28 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (>=5.0.0.Alpha1 <=5.0.5.Final)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version =5.0.0.Alpha1, =0.15.3, =0.15.3, =0.15.3, =0.15.3, =0.27.1, =0.27.1, =9.5.7, =3.5.0, =0.7.6, =0.7.6, =0.7.6, =0.7.2, =4.1.5, =4.7.2 and more Source cves: CVE-2023-0482 Source advisory: OSV:GHSA-2C6G-PFX3-W7H8...

at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8), at.porscheinformatik.zanata:stub-server (>=4.7.0 <=4.7.8) +455 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (>=2.0-RC1 <=3.15.3.Final)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version =2.0-RC1, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1.0.0, =0.2.0, =0.10.5-experimental and more Source cves: CVE-2023-0482 Source advisory: OSV:GHSA-2C6G-PFX3-W7H8...

PT-2025-4382

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 25.1.0 Description A critical issue was discovered in the SAML SSO implementation of Sentry, allowing an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on th...