GHSA-59W7-V8RR-PR4P OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Impact ACL Policies OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time. This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with alice/ while granting "bob" access to bob/,...

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

Impact ACL Policies OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time. This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with alice/ while granting "bob" access to bob/,...

EUVD-2024-2820

Malicious code in bioql PyPI...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.8.1 Vulnerability Details CVEID:CVE-2024-27043 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvbregisterdevice, pdvbdev is set equal...

CVE-2024-7594

A flaw was found in Hashicorp Vault. Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s...

CVE-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

CVE-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

CVE-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

PT-2024-38439

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Community Edition versions prior to 1.17.6 HashiCorp Vault Enterprise versions prior to 1.17.6, 1.16.10, and 1.15.15 Description The issue arises from the SSH secrets engine not requiring the valid principals list to contain a...