Vulnerability found in Ivanti Endpoint Manager

Ivanti has fixed vulnerabilities in Ivanti Endpoint Manager. Vulnerabilities have been fixed in Ivanti Endpoint Manager. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Remote code execution User rights Remote code execution...

Improper Authentication

org.apache.streampark, streampark is vulnerable to Improper Authentication. The vulnerability is due to improper session management allowing the "Authorization" credential to remain valid even after logout, enabling attackers to use this credential to initiate requests and potentially access data...

CVE-2024-36534

CVE-2024-36534 affects hwameistor v0.14.3 and earlier, with insecure permissions allowing an attacker to access sensitive data and escalate privileges by obtaining a service account token. The issue stems from misconfigured permissions that permit token access and privilege elevation within the s...

CVE-2024-36541

Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

cert-manager 安全漏洞

cert-manager is a certificate manager in the cert-manager open source. Adds certificates and certificate issuers as resource types in a Kubernetes cluster and simplifies the process of obtaining, renewing, and using these certificates. A security vulnerability exists in cert-manager v1.14.4 and...

PT-2024-27056 · Fabedge · Fabedge

Name of the Vulnerable Software and Affected Versions: fabedge version 0.8.1 Description: The issue concerns insecure permissions in fabedge, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For fabedge version 0.8.1,...

CVE-2024-36535

CVE-2024-36535 affects meshery v0.7.51 and earlier, with insecure permissions that allow an attacker to access the service account token, enabling data access and privilege escalation. Multiple sources (Red Hat, Veracode, OSV, NVD, CNNVD, CVE list, PT-2024-27055) corroborate this description. The...

CVE-2024-36534

Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36535

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

CVE-2024-36538 affects Chaos Mesh (v2.6.3 and earlier). The issue stems from insecure permissions that allow an attacker to access a service account token, enabling data access and privilege escalation. The Red Hat, NVD, OSV, CNNVD, CVE listing all describe the same flaw, with a base CVSS v3.1 sc...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

Meshery 安全漏洞

Meshery is a multi-service grid management plane open-sourced by Meshery. A security vulnerability exists in meshery v0.7.51 and earlier versions that stems from the presence of insecure privileges allowing an attacker to access sensitive data and elevate privileges by obtaining a token for a...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36533

Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36534

Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

The vulnerabilities of the event monitoring, threat detection, security analytics platforms of IBM QRadar Suite, as well as the IBM Cloud Pak for Security security platform, allow attackers to gain access to confidential information.

The vulnerabilities of event monitoring platforms, threat detection systems, security analytics in the IBM QRadar Suite, and IBM Cloud Pak for Security related to security configuration errors can be exploited by attackers operating remotely. This allows them to gain access to confidential...

CVE-2024-36533

CVE-2024-36533 affects Volcano (volcano-sh) with insecure permissions in version 1.8.2 and earlier. The underlying issue permits attackers to access sensitive data and escalate privileges by obtaining the service account token, potentially via the volcano.sh/volcano endpoint. Documented impact is...