146 matches found
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
CVE-2024-37288 affects Kibana via a YAML deserialization flaw that can lead to arbitrary code execution. Exploitation is possible without user interaction over network with low privileges, targeting environments using Elastic Security AI tools and an Amazon Bedrock connector; impact to confidenti...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...
PT-2024-5982 · Elastic · Kibana
Name of the Vulnerable Software and Affected Versions: Elastic Kibana affected versions not specified Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that...
Boosting efficiency with Wiz's AI-driven remediation steps powered by Amazon Bedrock
Wiz introduces AI-remediation steps powered by Amazon Bedrock to empower customers to remediate risks quickly...
Expanded Coverage and AWS Compliance Pack Updates in InsightCloudSec Coming Out of AWS Re:Invent 2023
It seems like it was just yesterday that we were in Las Vegas for AWS Re:Invent, but it’s already been almost two weeks since the conference wrapped up. As is always the case, AWS unveiled a host of new services throughout the week, including advancements around serverless, artificial intelligenc...
Mozilla: Missing Function Level Access Control in Mozilla formula containsRegular Expression Denial of Service (CVE-2023-25166)
Vulnerability description not provided...
Mojang Bedrock Dedicated Server整数溢出漏洞
Mojang Bedrock Dedicated Server is an official Minecraft Bedrock Edition server software from the Swedish company Mojang. Mojang Bedrock Dedicated Server is vulnerable to an integer overflow vulnerability that can be exploited by remote attackers to cause a PurchaseReceiptPacket::read packet...
CVE-2022-23884
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...
CVE-2022-23884
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...
CVE-2022-23884
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...
Integer overflow
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...
CVE-2022-23884
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...
CVE-2022-23884
CVE-2022-23884 affects Mojang Bedrock Dedicated Server 1.18.2. The issue is an integer overflow in the packet deserializer, specifically PurchaseReceiptPacket::_read, which allows a bound check bypass. Impact is described as high/critical depending on the metric (CVSS2: 7.5 (HIGH), CVSS3.1: 9.8 (...
Mojang Bedrock Dedicated Server 输入验证错误漏洞
Mojang Bedrock Dedicated Server is an official Minecraft Bedrock Edition server software from the Swedish company Mojang. Mojang Bedrock Dedicated Server is vulnerable to an integer overflow vulnerability that can be exploited by remote attackers to cause a PurchaseReceiptPacket::read packet...
Insecure Encryption
pocketmine/pocketmine-mp is using insecure encryption. The vulnerability exists in 'Minecraft Bedrock' function, due to authentication and protocol encryption are unchangeable servers are allowed to connect internet directly...
GHSA-H79X-98R2-G6QC Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP
Impact Minecraft Bedrock authentication and its protocol encryption are inseparably linked. One is not complete without the other. This vulnerability affects servers which are able to be directly connected to via the internet i.e. not behind a proxy. If you are using a proxy, please check that it...
Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP
Impact Minecraft Bedrock authentication and its protocol encryption are inseparably linked. One is not complete without the other. This vulnerability affects servers which are able to be directly connected to via the internet i.e. not behind a proxy. If you are using a proxy, please check that it...
GHSA-H77F-XXX7-4858 User impersonation due to incorrect handling of the login JWT
Impact This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your...