CVE-2024-45037

The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called...

BIT-CILIUM-OPERATOR-2023-39347 Cilium NetworkPolicy bypass via pod labels

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels...

[SECURITY] Fedora 38 Update: rubygem-yard-0.9.36-1.fc38

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions...

postgresql: extension script @substitutions@ within quoting allow SQL injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...

postgresql: extension script @substitutions@ within quoting allow SQL injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...

ROS-20231009-03

PostgreSQL database management system vulnerability is related to the possibility of SQL injection in extensions, that use quoting constructs @extowner@, @extschema@, or @extschema:...@ inside parentheses dollar quoting, '', or "". Exploitation of the vulnerability could allow an attacker acting...

CLSA-2023-1696537563 Fix CVE(s): CVE-2023-39417

SECURITY UPDATE: SQL injection when @extowner@, @extschema@, or @extschema:...@ appeared inside a quoting construct dollar quoting, '', or "" - debian/patches/CVE-2023-39417: reject substituting extension schemas or owners matching "$'. - CVE-2023-39417 -- Pavel Kopylov Fri, 15 Sep 2023 10:55:03...

CVE-2023-39347 Cilium NetworkPolicy bypass via pod labels

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels...

The code uses assembly for memory allocation, which can be complex and prone to errors.

Lines of code Vulnerability details Impact The code uses assembly for memory allocation, which can be complex and prone to errors. Inefficient memory management can lead to gas inefficiency and potential vulnerabilities. Proof of Concept The code uses assembly for memory allocation, which can be...

OESA-2023-1578 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS that supports almost all SQL constructs including transactions, subselects and user-defined types and functions. The postgresql package includes the client programs and libraries that you'll need to access a PostgreSQL DB...

The vulnerability of the PostgreSQL database management system, related to the possibility of SQL injections in extensions, allows attackers to execute arbitrary SQL queries against the database.

The vulnerability of the PostgreSQL database management system lies in the possibility of SQL injections through extensions that use citation constructs @extowner@, @extschema@, or @extschema:... within parentheses dollar quoting, 'or "'. Exploiting this vulnerability allows a malicious actor to...

SUSE CVE-2017-9274

A shell command injection in the obs-service-sourcevalidator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs...

Malicious code in aws-solutions-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d87219753522203f4379f860232eca25a18796c1ba879d9b3eca269fbd762c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1203 Malicious code in aws-solutions-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d87219753522203f4379f860232eca25a18796c1ba879d9b3eca269fbd762c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE: Security Advisory (SUSE-SU-2019:13921-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:0875-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 34 Update: rubygem-yard-0.9.26-3.fc34

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions...

The leap of a Cycldek-related threat actor

Introduction In the nebula of Chinese-speaking threat actors, it is quite common to see tools and methodologies being shared. One such example of this is the infamous "DLL side-loading triad": a legitimate executable, a malicious DLL to be sideloaded by it, and an encoded payload, generally dropp...

CVE-2020-8116

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...

The vulnerability of the Jenkins Script Security plugin, related to incorrect type conversion, allows attackers to invoke arbitrary constructs.

The vulnerability of the Jenkins Script Security plugin is related to incorrect type conversion. Exploiting this vulnerability allows a malicious actor to trigger arbitrary constructs remotely...