242 matches found
CVE-2024-24770
Vantage6 exposes two API endpoints, /recover/lost and /2fa/lost, which allow an attacker to enumerate existing usernames via recovery-email behavior or timing differences. Root cause: inadequate access controls on recovery utilities leading to user enumeration. Impact: potential targeted credenti...
CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...
vantage6 Security Vulnerabilities
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in versions of vantage6 prior to 4.2.1, which stems from an unrestricted CORS setting...
PT-2024-20105
Name of the Vulnerable Software and Affected Versions vantage6 affected versions not specified Description The vantage6 server has no restrictions on CORS settings, which should be configurable to set allowed origins. The impact is limited because v6 does not use session cookies. Recommendations ...
The vulnerability of the vantage6-UI interface of the Vantage6 confidential data protection platform allows a perpetrator to gain unauthorized access to the protected information.
The vulnerability of the vantage6-UI interface of the Vantage6 confidential data protection platform is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the protected information...
vantage6 Security Vulnerabilities
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage6 versions 4.2.0 and earlier that stems from not setting the security header...
PT-2024-20453 · Docker +2 · Docker +2
Name of the Vulnerable Software and Affected Versions: vantage6-UI affected versions not specified Description: The issue is related to the absence of certain security headers in the vantage6-UI, which is the official user interface for the vantage6 server. This problem has been addressed in a...
vantage6 Security Vulnerabilities
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage6 versions 4.2.2 and earlier, which stems from the ability to find out which usernames exist by calling API routes that sen...
Unspecified vulnerability in vantage6 (CNVD-2024-07864)
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability previously existed in vantage6 version 4.2.0 that stemmed from the ability to find out a username from the response time of a login request...
Unspecified vulnerability in vantage6 (CNVD-2024-07865)
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage that stems from the fact that input is not checked to see if it is encrypted if the task is created in encrypted...
Unencrypted Task Creation
vantage6 is vulnerable to Unencrypted Task Creation. The vulnerability is due to improper validation to check if the task is encrypted and if a task is created in an encrypted collaboration...
Insecure SSH Configuration
vantage6 is vulnerable to Insecure SSH Configuration. The vulnerability is due to the default configuration on nodes and servers, allowing root login with password authentication. This configuration is overly permissive...
Remote Code Execution (RCE)
vantage6 is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sanitization of environment variables. An authenticated user can inject code via environment variables, resulting in RCE...
vantage6 may create unencrypted tasks in encrypted collaboration
Impact There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Workarounds This is not an issue with the normal workflow...
GHSA-RJMV-52MP-GJRR vantage6 may create unencrypted tasks in encrypted collaboration
Impact There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Workarounds This is not an issue with the normal workflow...
vantage6 vulnerable to username timing attack
Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks Workarounds No...
GHSA-45GQ-Q4XH-CP53 vantage6 vulnerable to username timing attack
Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks Workarounds No...
vantage6 has insecure SSH configuration for node and server containers
Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...
vantage6 remote code execution vulnerability
Impact Authenticated users could inject code into algorithm environment variables Workarounds No...
CVE-2024-22193
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a tas...