PT-2024-37736 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 Description: A broken access control issue exists in the saml.ts file, allowing a user from one organization to update the Identity Provider IDP settings and...

CVE-2024-8754

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is...

CVE-2024-8754 External Control of Critical State Data in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is...

CVE-2024-8754 External Control of Critical State Data in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is...

PT-2024-39228 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.9.7 through 17.1.7 GitLab EE/CE versions 17.2 through 17.2.5 GitLab EE/CE versions 17.3 through 17.3.2 Description: An issue has been discovered in GitLab EE/CE, allowing an attacker to squat on accounts via linking...

Veeam Service Provider Console Installed (Windows)

Binary data veeamserviceproviderconsolewininstalled.nbin...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability in GitLab EE/CE versions prior to 16.9.7 through...

"There is no FIB [summary.xml]" error with Veeam Cloud Connect v12.2

Updated Hotfix Release -- September 30, 2024 On 2024-09-30, a new revision to the hotfix package listed in this article was released. This updated hotfix file coincides with a repackaged release of the Veeam Backup & Replication 12.2 ISO dated 20240926, which integrates the new hotfix package...

Improper Input Validation

github.com/cosmos/interchain-security is vulnerable to Improper Input Validation. The vulnerability is caused due to a missing validation on the ICS side to check if the signer matches the provider address. This can lead to any user opt-in, opt-out, change the commission rate, or change what publ...

The vulnerability of the file loading function of the backup and recovery software for remote and cloud-based Veeam Service Provider Console (VSPC) customers allows a hacker to execute arbitrary code on the VSPC server.

The vulnerability of the file loading function of the backup and data recovery software for remote and cloud-based Veeam Service Provider Console VSPC involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code on the VSPC...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from the inclusion of an authentication bypass vulnerability that could allow a low-privileged...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from contains a code injection vulnerability that allows a user with low privileges to upload...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from the inclusion of a code injection vulnerability that allows a low privileged user with REST AP...

GO-2024-3121 Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security

Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security...

RansomHub Claims Planned Parenthood Hack, Steals 93GB of Sensitive Data

RansomHub claims to have breached Intermountain Planned Parenthood, stealing 93GB of data. The healthcare provider is investigating the…...

GHSA-7Q74-G774-7X3G Interchain Security: The signers of ICS messages do not need to match the provider address

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: - MsgOptIn -- adds a validator to the consumer chain’s active set - MsgOptOut -- removes a validator from the consumer chain’s active set - MsgAssignConsumerKey -- changes the...

Interchain Security: The signers of ICS messages do not need to match the provider address

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: - MsgOptIn -- adds a validator to the consumer chain’s active set - MsgOptOut -- removes a validator from the consumer chain’s active set - MsgAssignConsumerKey -- changes the...

CVE-2024-45442

Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability...

PT-2024-5947 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC affected versions not specified Description: The issue is related to a code injection vulnerability that allows a low-privileged user to upload arbitrary files to the server, leading to remote code executio...

PT-2024-6330 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC affected versions not specified Description: An authentication bypass issue can allow a low-privileged attacker to access the NTLM hash of a service account on the VSPC server. This is related to insufficie...