PT-2024-1156 · Oracle · Oracle Audit Vault/Database Firewall

Name of the Vulnerable Software and Affected Versions: Oracle Audit Vault and Database Firewall versions 20.1 through 20.9 Description: The issue is related to insufficient input validation in the Firewall component of Oracle Audit Vault and Database Firewall, allowing a remote attacker to gain...

Oracle Audit Vault and Database Firewall Security Vulnerabilities

Oracle Audit Vault and Database Firewall is a database security solution from Oracle Corporation. A security vulnerability exists in Oracle Audit Vault and Database Firewall versions 20.1 through 20.9. An attacker could exploit the vulnerability to take over Oracle Audit Vault and Database Firewa...

Oracle Audit Vault and Database Firewall Security Vulnerabilities

Oracle Audit Vault and Database Firewall is a database security solution from Oracle Corporation. A security vulnerability exists in Oracle Audit Vault and Database Firewall versions 20.1 through 20.9. An attacker could exploit the vulnerability to access sensitive data...

Oracle Audit Vault and Database Firewall Security Vulnerabilities

Oracle Audit Vault and Database Firewall is a database security solution from Oracle Corporation. A security vulnerability exists in Oracle Audit Vault and Database Firewall versions 20.1 through 20.9. An attacker could exploit the vulnerability to perform unauthorized updates, insertions, or...

Race Condition

Audited is vulnerable to Race Condition. The vulnerability is caused due lack of proper synchronization mechanisms during the use of Thread.current. This potentially leads to logging of wrong username in an audit log...

CVE-2024-22047

A race condition flaw was found in Audited. This issue may allow an authenticated user to attribute audit log entries to another user...

GHSA-V444-JGGX-6V7F Duplicate Advisory: Race Condition leading to logging errors

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hjp3-5g2q-7jww. This link is maintained to preserve external references. Original Description A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries...

CVE-2024-22047

A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user...

Race condition

A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user...

CVE-2024-22047 Audited Log Integrity Errors Due to Race Condition

A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user...

CVE-2024-22047

The CVE-2024-22047 issue concerns the Ruby gem Audited (versions 4.0.0 through 5.3.3) where a race condition can cause audit log entries to be attributed to the wrong user. Connected Red Hat advisory RHSA-2024:2010 notes the same race condition affecting rubygem-audited and highlights risk of mis...

CVE-2024-22047 Audited Log Integrity Errors Due to Race Condition

A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user...

GHSA-VWCH-G97W-HFG2 CubeFS leaks users key in logs

CubeFS was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher...

CubeFS leaks users key in logs

CubeFS was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher...

GHSA-4248-P65P-HCRM Insecure random string generator used for sensitive data

CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...

Insecure random string generator used for sensitive data

CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...

GHSA-8579-7P32-F398 CubeFS timing attack can leak user passwords

A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the...

CubeFS timing attack can leak user passwords

A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the...

Authenticated users can crash the CubeFS servers with maliciously crafted requests

A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...

GHSA-QC6V-G3XW-GRMX Authenticated users can crash the CubeFS servers with maliciously crafted requests

A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...