Authentication Bypass

github.com/nats-io/nats-server is vulnerable to Authentication bypass. The vulnerability is due to a failure to enforce negative user permissions in one scenario. Attackers can exploit this by using a queue subscription on the wildcard to access denied subjects...

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

UBUNTU-CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

CVE-2022-29946: Undefined Security Weakness

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

CVE-2024-39518

A Heap-based Buffer Overflow vulnerability in the telemetry sensor process sensord of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service DoS. When the device is subscribed to a specific...

Azure CLI Credentials Gatherer

This module will collect the Azure CLI 2.0+ az cli settings files for all users on a given target. These configuration files contain JWT tokens used to authenticate users and other subscription information. Once tokens are stolen from one host, they can be used to impersonate the user from a...

Meta's 'Pay or Consent' Approach Faces E.U. Competition Rules Scrutiny

Meta's decision to offer an ad-free subscription in the European Union E.U. has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the...

SUSE-SU-2024:2247-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2024-34397: Fixed signal subscription unicast spoofing vulnerability bsc1224044...

Malicious code in action-cable_subscription_adapter (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6376 Malicious code in action-cable_subscription_adapter (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in OCI.DotNetSDK.Osuborganizationsubscription.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2764 Malicious code in @ccw-order/notification-subscription-v7 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @ccw-order/notification-subscription-v7 (npm)

--- -= Per source details. Do not edit below this line.=-...

End of Sale and Renewal for XenServer Standard and Premium Editions

Cloud Software Group has decided to end of sale EOS, and end of renewal EOR XenServer Standard and Premium Edition stand-alone offerings on June 3rd, 2024. This change is designed to simplify our product line and deliver superior value and user experience to our customers. From June 3rd onwards,...

CVE-2024-3961

The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsubscriber function in all versions up to, and including, 2.4.9. This makes it possible for...

CVE-2024-3961 ConvertKit <= 2.4.9 - Missing Authorization

The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsubscriber function in all versions up to, and including, 2.4.9. This makes it possible for...

PT-2024-28551 · WordPress · Convertkit

Name of the Vulnerable Software and Affected Versions: The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress versions up to, and including, 2.4.9 Description: The issue is related to a missing capability check on the tag subscriber function, allowi...

subscription-manager bug fix and enhancement update

An update is available for subscription-manager. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

Oracle Linux 9 : cockpit (ELSA-2024-3843)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3843 advisory. 311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110...

cockpit security update

311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in cockpit Orabug: 34030494 - Update documentation links Orabug: 30271413, Orabug: 32013095,...