Security Bulletin: Denial of service and security restrictions bypass might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-27351, CVE-2024-34064, CVE-2024-32879, CVE-2024-24786. Vulnerability Details CVEID:CVE-2024-24786 DESCRIPTION:...

GLSA-202407-05 : SSSD: Command Injection

The remote host is affected by the vulnerability described in GLSA-202407-05 SSSD: Command Injection A vulnerability has been discovered in SSSD. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo Linux...

GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

CVE-2024-28820

CVE-2024-28820 concerns the Three Rings OpenVPN LDAP plugin (openvpn-auth-ldap) 2.0.4. The flaw is a buffer overflow in extract_openvpn_cr (openvpn-cr.c) when handling the challenge/response password field; an attacker with a valid LDAP username who can control that field can supply input with mo...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

CVE-2024-38272 Auth Bypass in Quick Share

There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We...

CVE-2024-38272

CVE-2024-38272 affects Google's Quick Share (Windows) where an attacker can bypass the Accept File dialog, enabling a transfer without recipient consent. The vulnerability is described as an auth bypass in Quick Share for Windows; the issue is fixed in version 1.0.1724.0 and later. Connected sour...

GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp

URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...

Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6722 Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in killskids-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5293 Malicious code in killskids-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlаanderen.Basisregisters.Auth.AcmIԁm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlаandеren.Basisrеgisters.Auth.AcmIԁm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in en-conduit-electron-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2296 Malicious code in en-conduit-electron-auth (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in driverless-acquisition-blue-auth-token-validator (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2268 Malicious code in driverless-acquisition-blue-auth-token-validator (npm)

--- -= Per source details. Do not edit below this line.=-...