CVE-2025-25182: Authentication Bypass by Spoofing

Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the...

GO-2024-3210 Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio

Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio...

CVE-2024-8901

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901: Authentication Bypass by Spoofing

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901

CVE-2024-8901 concerns the AWS ALB Route Directive Adapter for Istio, which integrated OIDC-like JWT authentication into Kubeflow. The issue arises from missing signer and issuer validation for JWTs, allowing an attacker to spoof OIDC sessions by presenting a JWT signed by an untrusted entity. Th...

CVE-2024-8901 Lack of JWT issuer and signer validation

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901 Lack of JWT issuer and signer validation

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

Malware in availab-le-alb-um-zip-26387-this-is-the-second-album-of-a-band-called-adebisi-shank-pdmrd-ikxtvt

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9327 Malicious code in alb-um-availa-ble-zip-mp3-file-20395-ive-been-expecting-you-m3mwh-apmisl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22fc68d2042156469205e75f4a654f8557c933212d8ff61b7068167cfd7b344f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in file-alb-um-zip-new-mp3-126009-bitter-sweet-dz7i2-hidryu

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9328 Malicious code in alb-um-availa-ble-zip-mp3-file-30506-i-feel-alright-898re-atdkuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 301aedb3c629f2045611e487e9d753ff50c0a6fc1da4ee93c01ab32ee0cff0a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in file-alb-um-zip-new-mp3-36289-laru-beya-zk5v7-mtjfsf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-a-river-aint-too-much-to-love-0u85h-vysnxq

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9330 Malicious code in alb-um-availa-ble-zip-mp3-file-46046-radical-connector-m2ydd-nirtvy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c7604df6d26c098c3985382dc30aada82e32d972c2f8222802ff998dc52ecf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in alb-um-availa-ble-zip-mp3-file-30506-i-feel-alright-898re-atdkuh

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in availab-le-alb-um-zip-25931-the-life-aquatic-studio-sessions-mocn6-tnmvnd

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-20395-ive-been-expecting-you-m3mwh-apmisl

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-46046-radical-connector-m2ydd-nirtvy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in file-alb-um-zip-new-mp3-516808-dirt-femme-opjhu-pollak

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9329 Malicious code in alb-um-availa-ble-zip-mp3-file-38068-its-all-about-to-change-rnonb-pzjjbh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4008f42b5bc2b6647cc2d9e297edb68f60da9ce6c5a20e62b44cb70616a8a6d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...