CVE-2024-12908

Delinea addressed a reported case on Secret Server v11.7.31 protocol handler version 6.0.3.26 where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfull...

CVE-2024-12908

Delinea Secret Server v11.7.31 (protocol handler 6.0.3.26) is affected by a flaw in the protocol handler where URIs were compared before normalization/canonicalization, enabling potential over-matching against an approved list. This could allow a remote attacker to lure a user to a malicious web ...

CVE-2024-12908

Delinea addressed a reported case on Secret Server v11.7.31 protocol handler version 6.0.3.26 where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfull...

U.S. Dept Of Defense: Secret Access Key of AWS Firehose Disclosure

The domain had an endpoint that contained the secret access key of an AWS Firehose delivery stream encoded in base64. The secret access key was disclosed, allowing the record to be put into the Firehose delivery stream...

Malicious code in aws-iot-samples-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379933a89a9078f046a3ed35489373ccc8c0e070cef4700bbd90d36f087d5569 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server version v11.7.31, which stems from a comparison of URIs before normalization and canonicalization in a protocol handler function, which may result in an...

PT-2024-17792 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea Secret Server version 11.7.31 protocol handler version 6.0.3.26 Description: The issue arises from the comparison of URI's before normalization and canonicalization within the protocol handler function, potentially leading to over...

You Need to Create a Secret Password With Your Family

AI voice cloning and deepfakes are supercharging scams. One method to protect your loved ones and yourself is to create secret code words to verify someone’s identity in real time...

Malicious code in old-celo-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1842e08f1ce198d27488ce0f57a12762160650f8c130e49d19053af3f86147 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12582

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the...

CVE-2024-12582 Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the...

CVE-2024-12582 Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the...

CVE-2024-12582

CVE-2024-12582 affects the Skupper/Red Hat Service Interconnect console. A flaw in the default authentication method persists a random admin password in plaintext in a Kubernetes secret or podman volume, enabling an attacker to read user files inside the container and potentially trigger resource...

GHSA-XWX7-P63R-2RJ8 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If...

Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If...

CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

Malicious code in tree-sitter-dockerfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 345b2afbf518dc7083621e0f9fb5e7e8b109a319cc7aec619f17c7aa9b18deca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56362

Navidrome is affected by CVE-2024-56362, a vulnerability where the JWT secret is stored in plaintext in the navidrome.db database file under the property table. This insecure storage allows anyone with access to the database file to retrieve the secret, potentially enabling token forgery and acco...

CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...