SUSE CVE-2019-11243

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig method returns a copy of the provided config, with credentials removed bearer token, username/password, and client certificate/key data. In the affected versions, rest.AnonymousClientConfig did not effectively clear service...

SUSE CVE-2019-11253

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming...

SUSE CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

SUSE CVE-2019-17382

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password i.e., anonymously. All created elements...

SUSE CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input...

PT-2023-35332 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.272 Description: The issue is related to the elimination of anonymous module init and module exit in the net: mlx5 module. The actual impact and attack plausibility have not yet been proven. Recommendation...

PT-2023-35004 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: The issue is related to the elimination of anonymous module init and module exit in the net: mlx5 module. The actual impact and attack plausibility have not yet been proven. It was introduced...

U.S. Department of State: LDAP anonymous access enabled at certrep.pki.state.gov:389

LDAP anonymous access was enabled on the subdomain certrep.pki.state.gov, allowing unauthorized access to the LDAP server...

Anonymous Leaks 128 GB of Data from Russian ISP Convex

By Waqas The leaked data apparently belongs to Convex, the leading Russian internet provider. This is a post from HackRead.com Read the original post: Anonymous Leaks 128 GB of Data from Russian ISP Convex...

UBUNTU-CVE-2023-22500

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

CISA Releases Eight Industrial Control Systems Advisories

CISA released eight Industrial Control Systems ICS advisories on January 26, 2023.These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

Media Library Block - Moderately critical - Information Disclosure - SA-CONTRIB-2023-003

The Media Library Block module allows you to render a media entity in a block. The module does not properly check media access in some circumstances. This may result in unauthorized users including anonymous users seeing media items they are not authorized to access if a block containing a...

PT-2023-2589 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 7.13.15 Atlassian Confluence Server versions 7.14.0 through 7.19.7 Atlassian Confluence Server versions 7.20.0 through 8.2.0 Atlassian Confluence Data Center versions prior to 7.13.15 Atlassian...

3Commas API Database Leaked by Anonymous Hacker

By Deeba Ahmed 3Commas' CEO, Yuriy Sorokin, has acknowledged the breach. This is a post from HackRead.com Read the original post: 3Commas API Database Leaked by Anonymous Hacker...

Code injection

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll...

CVE-2022-41964 BigBlueButton contains Response leaks in anonymous polls

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll...

CVE-2022-41964 BigBlueButton contains Response leaks in anonymous polls

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll...

CVE-2022-41964 BigBlueButton contains Response leaks in anonymous polls

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll...

BigBlueButton 信息泄露漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. An information disclosure vulnerability exists in versions of BigBlueButton prior to 2.4.0, which can be exploited by an attacker to start a subscription to the results of an anonymous poll before it is...

USN-5779-1 linux-azure, linux-azure-5.15, linux-azure-fde vulnerabilities

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-43945 Jann Horn discovered that the...