GHSA-WXCX-GG9C-FWP2 TorchServe vulnerable to bypass of allowed_urls configuration

Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

Unveiling Key Insights from the 2024 Take Command Summit

The 2024 Take Command Summit, held virtually in partnership with AWS, united over 2,000 security professionals to delve into critical cybersecurity issues. Our infographic captures the essence of the summit, showcasing expert insights from 10 sessions on topics like new attack intelligence, AI...

SAP AI Core Vulnerabilities Expose Customer Data to Cyber Attacks

Cybersecurity researchers have uncovered security shortcomings in SAP AI Core cloud-based platform for creating and deploying predictive artificial intelligence AI workflows that could be exploited to get hold of access tokens and customer data. The five vulnerabilities have been collectively...

resource-agents bug fix update

An update is available for resource-agents. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The resource-agents packages provide the Pacemaker and RGManager...

MAL-2024-7751 Malicious code in img-aws-s3-object-multipart-copy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fdc2d1b94cc9bdb2bee2f06bd13d0be50208d8185a82a733718d2edcdcee70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Citrix DAAS Console

Introduction This article is a summary of the top support articles related to Citrix Daas web consoles: Web Studio and Monitor. Top Knowledge Content Director CTX257614 - How to create a detailed custom report from the Cloud Hosted Director Monitor Web Studio CTX477615 - Studio Console Shows...

Ubuntu 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6868-2)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6868-2 advisory. Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History...

USN-6868-2: Linux kernel (AWS) vulnerabilities

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability CVE-2022-0001 were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive...

Critical Photon OS Security Update - PHSA-2024-4.0-0649

Updates of 'linux', 'linux-aws' packages of Photon OS have been released...

This Week in Spring - July 9th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's been! We've got a lot to get into, so let's dive right in. I quite liked this talk, Continuations: The magic behind virtual threads in Java by Balkrishna Rawool @ Spring I/O 2024 In last week's episode of...

Moderate Photon OS Security Update - PHSA-2024-4.0-0648

Updates of 'linux', 'linux-aws' packages of Photon OS have been released...

USN-6870-2: Linux kernel (AWS) vulnerabilities

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. CVE-2024-21823 Several security issues were...

USN-6873-1: Linux kernel vulnerabilities

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. CVE-2024-21823 Several security issues were...

USN-6870-1: Linux kernel vulnerabilities

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. CVE-2024-21823 Several security issues were...

Ubuntu 20.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6870-2)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6870-2 advisory. It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for...

Ubuntu: Security Advisory (USN-6865-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-6873-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6868-1: Linux kernel vulnerabilities

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability CVE-2022-0001 were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: runc, minify, kube-vip, wire-go, rabbitmq-messaging-topology-operator, src-fingerprint, policy-controller, temporal-ui-server, controller-gen, capslock, flux-image-reflector-controller, kwok, kind, eksctl, pulumi-kubernetes-operator, tflint, yq, task, dataplaneapi,...

GO-2024-2440 Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws

Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws...