PT-2026-55089

Component: io.crate.protocols.http.HttpBlobHandler Affected: verified against CrateDB 6.2.7 latest at time of report; the bug has existed since the blob HTTP handler was introduced Impact: any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs...

EUVD-2024-2258

Malicious code in bioql PyPI...

CVE-2024-39897

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...

BOSH Director VM Agent Anonymous Endpoint Vulnerability

BOSH is an open source tool for deployment and lifecycle management of large-scale distributed systems, of which Director VM is a virtual machine and stemcell is an image. A security vulnerability exists in the endpoint of the Agent in the BOSH Director VM using stemcell versions prior to 3232.6...

CVE-2012-5501: Undefined Security Weakness

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...