org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in...

org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in...

CVE-2024-53335

TOTOLINK A810R V4.1.2cu.5182B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi...

OPENSUSE-SU-2024:0370-1 Security update for cobbler

This update for cobbler fixes the following issues: Update to 3.3.7 Security: Fix issue that allowed anyone to connect to the API as admin CVE-2024-47533, boo1231332 bind - Fix bug that prevents cname entries from being generated successfully Fix build on RHEL9 based distributions fence-agents-al...

Red Hat Keycloak 信任管理问题漏洞

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from sensitive data being embedded as a default value in bytecode or environment...

MAL-2024-10846 Malicious code in river-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28a856c975ffce278cd6752a94fda3cc892d9af33858cc33d5dcb4f0bdafeb62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in river-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28a856c975ffce278cd6752a94fda3cc892d9af33858cc33d5dcb4f0bdafeb62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ManageEngine ADAudit Plus < Build 8123 SQLi (CVE-2024-49574)

The version of ManageEngine ADAudit Plus installed on the remote host is prior to build 8123. It is, therefore, affected by a SQL injection vulnerability in the reports module.. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version...

DEBIAN-CVE-2024-53076

In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iiogtsbuildavailscaletable If pertimescalesi or pertimegainsi kcalloc fails in the for loop of iiogtsbuildavailscaletable, the errfreeout will fail to call kfree each time...

AZL-53897 CVE-2024-53076 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iiogtsbuildavailscaletable If pertimescalesi or pertimegainsi kcalloc fails in the for loop of iiogtsbuildavailscaletable, the errfreeout will fail to call kfree each time...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582

Cachi2 (open source CLI) is affected up to version 0.13.x; when an unhandled exception occurs, the tool logs function locals, potentially exposing secrets in CI/build logs. Version 0.14.0 includes a patch to fix this. No other exploit details are provided in the documents. Remediation: upgrade to...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

SUSE CVE-2024-52867

guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns e.g., for setuid and setgid programs are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, a...

Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories...

Cachi2 安全漏洞

Cachi2 is an open source CLI tool from containerbuildsystem. A security vulnerability exists in Cachi2 versions prior to 0.14.0, which stems from the fact that the tool logs each function's local variables when an unhandled exception is triggered, potentially leading to the display of secret...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that stems from a faulty 6 GHz scan build...

libvpx security update

1.9.0-8 - Add patch to fix integer overflows. - Disable LTO to fix build - Resolves: RHEL-58144...

DEBIAN-CVE-2024-52867

guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns e.g., for setuid and setgid programs are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, a...