CVE-2022-24455: Undefined Security Weakness

Windows CD-ROM Driver Elevation of Privilege Vulnerability...

Windows CD-ROM Driver Elevation of Privilege Vulnerability

...

Microsoft Windows CD-ROM Driver 权限许可和访问控制问题漏洞

Microsoft Windows is a CD-ROM driver from Microsoft Corporation, and an elevation of privilege vulnerability exists in the Microsoft Windows CD-ROM Driver, which could be exploited by attackers to execute arbitrary code with elevated privileges...

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...

CVE-2021-3602: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...

InsightAppSec GitHub Integration Keeps Risky Code From Reaching Production

We've all been there. The software development life cycle SDLC is moving at a mile a minute. Developers are writing code, updating features, and all the while attempting to keep everything introduced into production as safe and secure as possible. GitHub Actions are essential to automation and...

CVE-2022-22321

IBM MQ Appliance CVE-2022-22321 affects the 9.2 CD and 9.2 LTS releases, where local-messaging user passwords are stored using a hash that provides insufficient protection. The vulnerability can lead to exposure of sensitive data via password hashes. IBM’s remediation guidance (in IBM MQ Applianc...

CVE-2021-38986

The CVE-2021-38986 issue affects IBM MQ Appliance 9.2 CD and 9.2 LTS, where sessions are not invalidated after logout, allowing an authenticated user to impersonate another user. Root cause is insufficient session expiration. IBM/IBM X-Force assign a base CVSS around medium (5.6). Remediation: up...

Security Bulletin: IBM MQ Appliance is affected by a Java vulnerability (CVE-2021-35578)

Summary IBM MQ Appliance has resolved a Java vulnerability. Vulnerability Details CVEID: CVE-2021-35578 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact...

CVE-2022-22321

IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368...

CVE-2021-38986

IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942...

7 Container Security Best Practices For Better Apps

Explore how to implement 7 container security best practices within a CI/CD pipeline built with tools from Amazon Web Services AWS...

The vulnerability of emulation on CD-ROM-based hypervisors of VMware ESXi, VMware Workstation, and VMware Fusion allows a hacker to execute arbitrary code.

The vulnerability of CD-ROM emulation devices in VMware ESXi, VMware Workstation, and VMware Fusion lies in the writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2021-3557

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest...

PT-2022-10470 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: argocd affected versions not specified Description: A flaw was found in argocd, allowing any unprivileged user to deploy argocd in their namespace. With the created ServiceAccount argocd-argocd-server, the unprivileged user can read all...

VMware Fusion 12.x < 12.2.0 Heap Overflow RCE (VMSA-2022-0001)

VMware Fusion contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. Not...

GHSA-63QX-X74G-JCR7 Path traversal and dereference of symlinks in Argo CD

Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files...

Path traversal and dereference of symlinks in Argo CD

Impact All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files...