Fedora 39 : jupyterlab / python-notebook (2024-1673c2696e)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-1673c2696e advisory. Update of jupyterlab and notebook including fix for CVE-2024-22420 . Tenable has extracted the preceding description block directly from the Fedora...

Line Security Breach

Line is an instant messaging platform from Line Inc. A security vulnerability exists in Line version v13.6.1, which stems from the angel coffee applet that may disclose access tokens...

CVE-2020-36771

CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authentication token via the process list and gain code execution as another user...

JupyterLab Security Breach

JupyterLab is an extensible environment for interactive and reproducible computation, based on the Jupyter Notebook and architecture. A security vulnerability exists in JupyterLab. An attacker exploiting this vulnerability could expose tokens to third parties...

Jenkins Dingding JSON Pusher Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-30313 · Pilos · Pilos

Name of the Vulnerable Software and Affected Versions: PILOS versions prior to 2.3.0 Description: The password reset component in PILOS uses the hostname supplied within the request host header when building a password reset URL. This could allow manipulation of the URL sent to PILOS users,...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

PT-2023-25636 · Unknown · Boomerang Parental Control

Name of the Vulnerable Software and Affected Versions: Boomerang Parental Control application versions prior to 13.83 for Android Description: An issue was discovered in the Boomerang Parental Control application where the app is missing the android:allowBackup="false" attribute in the manifest...

Jenkins plugins Multiple Vulnerabilities (2023-10-25)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes. This results in a stor...

Improper log output when using GitHub Status Notifications in spinnaker

Impact ONLY IMPACTS those use GitHub Status Notifications Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the...

GHSA-RQ5C-HVW6-8PR7 Improper log output when using GitHub Status Notifications in spinnaker

Impact ONLY IMPACTS those use GitHub Status Notifications Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the...

CVE-2023-39348 Improper log output when using GitHub Status Notifications in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log...

CVE-2023-39348

CVE-2023-39348 affects Spinnaker and is caused by log output for GitHub status notifications being set to FULL, potentially exposing GitHub tokens in logs. The issue is limited to users of GitHub Status Notifications and could enable token exposure with elevated access to repositories outside of ...

PT-2023-26894 · Spinnaker · Spinnaker

Name of the Vulnerable Software and Affected Versions: Spinnaker affected versions not specified Description: Spinnaker is an open source, multi-cloud continuous delivery platform. The log output when updating GitHub status is improperly set to FULL always, which could output GitHub tokens to a l...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

platform: token exposed at importing project

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability...

PT-2023-26895

Name of the Vulnerable Software and Affected Versions Sentry versions 22.1.0 through 23.7.2 Description Sentry is an error tracking and performance monitoring platform. An attacker with access to a token with few or no scopes can query "/api/0/api-tokens/" for a list of all tokens created by a...

Gitlab -- Vulnerabilities

Gitlab reports: ReDoS via ProjectReferenceFilter in any Markdown fields ReDoS via AutolinkFilter in any Markdown fields Regex DoS in Harbor Registry search Arbitrary read of files owned by the "git" user via malicious tar.gz file upload using GitLab export functionality Stored XSS in Web IDE Beta...

PT-2023-24122 · Hashicorp +1 · Hashicorp Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6 HashiCorp Nomad Enterprise version 1.4.10 Description: A vulnerability exists where the API caller's ACL token secret ID is exposed to Sentinel policies. Additionally, ACL policies usin...