10590 matches found
CVE-2024-9202 EDC DataSetResolver policy filtering missing
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...
CVE-2024-9202
CVE-2024-9202 affects Eclipse Dataspace Components versions 0.1.3–0.9.0. The Connector’s catalog filtering fails for single-dataset requests, potentially allowing unauthorized parties to view restricted datasets. The issue stems from missing filtering in the DatasetResolverImpl (lines 76–79). Exp...
CVE-2024-9202: Missing Authorization
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...
Eclipse Dataspace Components security vulnerabilities
Eclipse Dataspace Components is a development connector for the Eclipse Dataspace Components open source. A security vulnerability exists in Eclipse Dataspace Components versions 0.1.3 through 0.9.0, which stems from a lack of proper filtering to expose sensitive information...
PT-2024-39485 · Eclipse · Eclipse Dataspace Components
Name of the Vulnerable Software and Affected Versions: Eclipse Dataspace Components versions 0.1.3 through 0.9.0 Description: The issue concerns the Connector component in Eclipse Dataspace Components, which is responsible for filtering datasets that another party can see in a requested catalog...
Malware in design-system-components-angular
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in design-system-components-angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa76659f890e0326b1b129f7cf3c39dd4b242fa297217ef6b98e4b34fa602ba2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in livingdesign-components
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in livingdesign-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9ad15e8dcaf3a6c94d2739771d75df50a809e5356b448918bf83199d2688e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8958 Malicious code in livingdesign-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9ad15e8dcaf3a6c94d2739771d75df50a809e5356b448918bf83199d2688e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Mojo components Data Compromise
The vulnerability of the Mojo browser components in Microsoft Edge and Google Chrome is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service interruptions through a specially...
Microsoft Edge Google Chrome Authentication Bypass
The vulnerability of Microsoft Edge and Google Chrome browsers’ authentication components is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...
SOFA Hessian Remote Command Execution (RCE) Vulnerability
Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on...
Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. The update addresses these issues. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper...
CVE-2024-40866
The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing...
CVE-2024-44187
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. A malicious website may exfiltrate data cross-origin...
RHSA-2024:2353 Red Hat Security Advisory: mingw components security update
Bulletin has no description...
RHSA-2024:2961 Red Hat Security Advisory: Image builder components bug fix, enhancement and security update
Bulletin has no description...