VMware Spring Cloud Config 安全漏洞

VMware Spring Cloud Config is a configuration management solution for distributed systems from VMware. The product primarily provides server and client support for external configuration in distributed systems. A security vulnerability exists in VMware Spring Cloud Config versions 2.2.1 through...

The vulnerability of HashiCorp’s Vault and Vault Enterprise storage platforms, which stem from lack of access control mechanisms, allows attackers to gain access to potentially confidential information.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms for corporate information lies in their lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to potentially confidential information...

Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: In this case the SessionManager persists the first token it retrieves and will continue to use that...

Improper Authorization

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Improper Authorization due to not using the Vault token sent by clients using a X-CONFIG-TOKEN header...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to an Observable Timing Discrepancy in Vault (CVE-2023-25000)

Summary Vault is used by IBM Storage Fusion Data Foundation in mcg, ocs, odr, cephcsi, and odr operators as part of credential management. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2023-25000. Vulnerability Details...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper and Incorrect Authorization and SQL Injection in Vault (CVE-2023-0665, CVE-2023-24999, CVE-2023-0620)

Summary Vault is used by IBM Storage Fusion Data Foundation as part of user authentication. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2023-0665, CVE-2023-24999, CVE-2023-0620. Vulnerability Details CVEID:CVE-2023-0665...

ROS-20250402-08

The vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms is related to the fact that the application allows the use of entity aliases mapped to a single resource with the same alias name. Exploitation of the vulnerability could allow an attacker actin...

Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1

Summary This SB contains a list for all CVE's listed here - CVE-2022-36083, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2021-21797, CVE-2022-35941, CVE-2021-42248, CVE-2021-42836, CVE-2022-40186, CVE-2022-41316, CVE-2021-36090, CVE-2020-29529, CVE-2020-7219 fixed in 3.5.1 Vulnerability...

1Password - Enterprise Password Manager: #**CSV Injection in shared passwords leads to complete Private Vault Exfiltration**

Vulnerability description not provided...

CVE-2025-1636

Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faul...

CVE-2025-1636

Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faul...

SUSE-RU-2025:0791-1 Recommended update 4.3.15 for Multi-Linux Manager Client Tools

This update fixes the following issues: ansible: - Security issues fixed: CVE-2024-8775: Fixed issue where sensitive information stored in Ansible Vault files could be exposed in plaintext bsc1230601 spacewalk-client-tools: - Version 4.3.22-0 Allow translation to wrap strings as weblate forces it...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-846)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-846 advisory. A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, secrets-store-csi-driver-provider-gcp, cni-plugins, grafana-operator, kubevela, oras, hello-world-golang, smarter-device-manager, q, dive, thanos, temporal-ui-server, kubeflow-pipelines, litefs, task, aws-efs-csi-driver, gitness,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, nodetaint, prometheus-bind-exporter, sbomqs, aws-flb-cloudwatch, fulcio-fips, kyverno-policy-reporter, docker-credential-gcr, kpt, cue, k8ssandra-operator, cfssl, minio, prometheus-node-exporter-fips, ferretdb, nri-kafka, direnv, kine,...

Medium: ansible-core

Issue Overview: A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in...

Medium: ansible-core

Issue Overview: A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in...

JetBrains TeamCity Cross-Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a cross-site...

Updated python-ansible-core packages fix security vulnerabilities

Exposure of sensitive information in Ansible vault files due to improper logging. CVE-2024-8775 Ansible-core user may read/write unauthorized content. CVE-2024-9902 Unsafe tagging bypass via hostvars object in ansible-core. CVE-2024-11079...

MGASA-2025-0052 Updated python-ansible-core packages fix security vulnerabilities

Exposure of sensitive information in Ansible vault files due to improper logging. CVE-2024-8775 Ansible-core user may read/write unauthorized content. CVE-2024-9902 Unsafe tagging bypass via hostvars object in ansible-core. CVE-2024-11079...