83 matches found
Missing permission checks in contrast-continuous-application-security allow enumerating Contrast metadata
contrast-continuous-application-security 3.11 and earlier does not perform permission checks in several HTTP endpoints that fill list box options with the names of the configured Contrast metadata. This allows attackers with Overall/Read permission to enumerate the names of configured Contrast...
CSRF vulnerability and missing permission check in contrast-continuous-application-security
contrast-continuous-application-security 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, AP...
PT-2026-51809
Name of the Vulnerable Software and Affected Versions Jenkins Contrast Continuous Application Security Plugin versions prior to 3.12 Description Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata. Recommendations Update Jenkin...
Description of the security update for SharePoint Server 2019 Language Pack: May 12, 2026 (KB5002872)
None None...
GHSA-RH99-WC69-C255 Contras Affected by CopyFile Policy Subversion via Symlinks
Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...
Contras Affected by CopyFile Policy Subversion via Symlinks
Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...
GO-2026-4863 Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast
Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast...
PT-2026-29926
Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast...
GHSA-G9WW-X58F-9G6M Contrast BadAML injection allows arbitrary code execution
BadAML BadAML is an AML injection attack that exploits the ACPI interface and allows arbitrary code execution in a confidential VM. The attack was first published in 2024: - - Impact An attacker with control over the host which is assumed in the attacker model of Contrast can execute malicious AM...
MiracleLinux 4 : spice-gtk-0.20-11.AXS4 (AXSA:2014-014:01)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-014:01 advisory. Client libraries for SPICE desktop servers. Security issues fixed with this release: CVE-2013-4324 spice-gtk 0.14, and possibly other versions, invokes the...
Friday Squid Blogging: Squid Camouflage
New research: Abstract: Coleoid cephalopods have the most elaborate camouflage system in the animal kingdom. This enables them to hide from or deceive both predators and prey. Most studies have focused on benthic species of octopus and cuttlefish, while studies on squid focused mainly on the...
GO-2025-4078 Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast
Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast...
EUVD-2025-36551
Contrast has insecure LUKS2 persistent storage partitions may be opened and used...
GHSA-F5P4-P5Q5-JV3H Contrast has insecure LUKS2 persistent storage partitions may be opened and used
Summary A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker. LUKS2 volume metadata is a not authenticated and b supports null...
Files or Directories Accessible to External Parties
Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the secure persistent volume feature. An attacker can access confidential data stored in persistent volumes by providing a crafted LUKS2 volume with a null key-encryption algorithm...
EUVD-2013-6282
Malware in sbrugna...
EUVD-2025-29522
Malicious code in bioql PyPI...
EUVD-2022-7109
Malicious code in bioql PyPI...