Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component, an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component...

CVE-2024-32482 Tillitis TKey Signer possible RAM disclosure vulnerability

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the...

CVE-2024-32482

The CVE-2024-32482 concerns the Tillitis TKey Signer device application (ed25519 signer). A vulnerability can disclose portions of the TKey’s data in RAM over the USB interface when the device is touched and a custom client is used. No secret is disclosed. Exploitation requires local access via U...

CVE-2024-23840

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. "goreleaser release --debug" log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...

CVE-2023-30617

Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entir...

OTCLient Injection Vulnerability

OTCLient is a replacement tibia client for otserv, written in C++20 and Lua, and is made on a modular system that uses lua scripting to implement in-game interfaces and features. OTCLient suffers from an injection vulnerability. An attacker could use this vulnerability to remotely run commands on...

GHSA-HP56-XVF4-G6WR Cros secrets may be disclosed to untrusted relay

An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...

Code injection

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk = 2.1.0p13, Checkmk = 2.0.0p29, and all versions of Checkmk 1.6.0 EOL allows an attacker to gain access to the host secret through the unprotected agent updater log file...

CVE-2022-48319

CVE-2022-48319 describes a local-information-disclosure vulnerability in Tribe29’s Checkmk where an attacker can access the host secret via the unprotected cmk-update-agent.log. Affected: Checkmk versions <= 2.1.0p13,

CVE-2022-48319 Host secret disclosed in Checkmk logs

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk = 2.1.0p13, Checkmk = 2.0.0p29, and all versions of Checkmk 1.6.0 EOL allows an attacker to gain access to the host secret through the unprotected agent updater log file...

PT-2023-1484 · Amd · Amd Secure Encrypted Virtualization

Name of the Vulnerable Software and Affected Versions: AMD Secure Encrypted Virtualization SEV affected versions not specified Description: The issue is related to insufficient input validation in the implementation of AMD Secure Encrypted Virtualization SEV microcode in AMD processors. This coul...

CVE-2022-39397

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

Code injection

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

CVE-2022-39397: Exposure of Sensitive Information to an Unauthorized Actor

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

CVE-2022-39397

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

CVE-2022-39397 Exposure of sensitive information in aliyun-oss-client

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1...

GHSA-3W3H-7XGX-GRWC Leak in Aliyun KeySecret

Impact Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally. Patches This have already been solved. Workarounds No, It cannot be patched without upgrading References No For more information If you have any questions or comments abou...

Leak in Aliyun KeySecret

Impact Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally. Patches This have already been solved. Workarounds No, It cannot be patched without upgrading References No For more information If you have any questions or comments abou...

Leak in Aliyun KeySecret

Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally...

CVE-2022-40262 The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines VMs and bypassing memory isolation and...