CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: gitleaks, rabbitmq-cluster-operator-fips, terraform-provider-acme-fips, temporal-server, vault-secrets-operator, cargobump, kube-fluentd-operator, terraform-provider-azuread-fips, velero, doppler-kubernetes-operator, tkn, gh, slsa-verifier, terraform-provider-random,...

OPENSUSE-SU-2025:14905-1 crane-0.20.3-2.1 on GA media

These are all security issues fixed in the crane-0.20.3-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-34679

Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege...

CVE-2024-34679

Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege...

CVE-2024-34679

Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege...

CVE-2024-34679

CVE-2024-34679 affects Crane; versions prior to SMR Nov-2024 Release 1 are vulnerable due to incorrect default permissions, permitting local attackers to access files with the phone privilege. The issue is documented across multiple feeds (Red Hat, NVD, CNVD, etc.) and is addressed by updating Cr...

CVE-2024-34679

Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SMR Nov-2024 Release 1 prior to version 1, which stems from Crane containing an incorrect...

PT-2024-26100 · Crane · Crane

Name of the Vulnerable Software and Affected Versions: Crane versions prior to SMR Nov-2024 Release 1 Description: The issue is related to incorrect default permissions, allowing local attackers to access files with phone privilege. Recommendations: For versions prior to SMR Nov-2024 Release 1,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: certificate-transparency, nvidia-container-toolkit, neuvector-scanner, gitleaks, ferretdb, k8sgpt, hubble-ui-backend-fips, kubecolor, redka, go-md2man, karpenter, dockerize-fips, grafana-agent-operator, cortex, flux-notification-controller,...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: argo-workflows, k8sgpt, goreleaser, timoni, nerdctl, flux, guac, slsa-verifier, ctop, cadvisor, ko-fips, cadvisor-fips, aactl, buildkitd, dagger, pulumi, kubevela, up, eksctl, bom, scorecard, kargo, argo-workflows-fips, docker-machine-driver-harvester, loki,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: argo-workflows, k8sgpt, goreleaser, timoni, nerdctl, flux, guac, slsa-verifier, ctop, cadvisor, ko-fips, cadvisor-fips, aactl, buildkitd, dagger, pulumi, kubevela, up, eksctl, bom, scorecard, kargo, argo-workflows-fips, docker-machine-driver-harvester, loki,...

USN-5872-1: NSS vulnerabilities

Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. CVE-2022-22747 Ronald Crane discovered that NSS incorrectly handled certain memory operations. A remote attacker...

crane-kit.com Cross Site Scripting vulnerability OBB-3076205

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Advanced Admin Search plugin <= 1.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Advanced Admin Search plugin versions = 1.1.5. Solution Update the WordPress Advanced Admin Search plugin to the latest available version at least 1.1.6...

WordPress Popup Like box plugin <= 3.6.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Popup Like box plugin versions = 3.6.0. Solution Update the WordPress Popup Like box plugin to the latest available version at least 3.6.1...

WordPress Conference Scheduler plugin <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Conference Scheduler plugin versions = 2.4.2. Solution Update the WordPress Conference Scheduler plugin to the latest available version at least 2.4.3...

WordPress Delete Old Orders plugin <= 0.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Delete Old Orders plugin versions = 0.2. Solution Deactivate and delete. This plugin has been closed as of February 15, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Mapping multiple URLs redirect same page plugin <= 5.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Mapping multiple URLs redirect same page plugin versions = 5.8. Solution Deactivate and delete. This plugin has been closed as of February 14, 2022 and is not available for download. This closure is temporary,...

WordPress Bank Mellat plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Bank Mellat plugin versions = 1.3.7. Solution Deactivate and delete. This plugin has been closed as of February 16, 2022 and is not available for download. This closure is temporary, pending a full review...