CVE-2024-36540

The CVE refers to CVE-2024-36540 affecting external-secrets v0.9.16, where insecure permissions in the service account token handling allow an attacker to access sensitive data and escalate privileges. The issue is described across multiple feeds as a root-cause of insecure permissions enabling t...

CVE-2024-36537

CVE-2024-36537 : cert-manager v1.14.4 contains an insecure permissions flaw that allows an attacker to access the service account token and escalate privileges, per NVD/Red Hat/IBM notes. Root cause is improper access control on credentials, enabling exposure of sensitive data. The connected advi...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27055 · Meshery · Meshery

Name of the Vulnerable Software and Affected Versions: meshery version 0.7.51 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For meshery version 0.7.51, update to a...

CVE-2024-36539

In Contour 1.28.3, insecure permissions on the service account allow attackers to access the token and escalate privileges, enabling sensitive data access. Affects Contour (Kubernetes ingress controller) v1.28.3; root cause is improper token permissions. Documented impact: high confidentiality, i...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27059 · Contour · Contour

Name of the Vulnerable Software and Affected Versions: contour version 1.28.3 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For contour version 1.28.3, update the...

CVE-2024-36536

CVE-2024-36536 affects fabedge v0.8.1 due to insecure permissions that let attackers access sensitive data and escalate privileges by obtaining a service account token. Red Hat, OSV and related advisories corroborate the same issue across fabedge components. Impact is high: confidentiality, integ...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-29070 Apache StreamPark: session not invalidated after logout

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2024-2600)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2600 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data, thereby increasing their privileges.

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data, thereby...

The vulnerability of the Servlet component of the Oracle Reports Developer reporting software allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the Servlet component in the Oracle Reports Developer reporting software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability of the Approvals component of the Oracle Purchasing software, which handles purchase orders, allows a hacker to gain read, modify, add, or delete access to data.

The vulnerability of the Approvals component in the Oracle Purchasing software for processing purchase orders involves insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

The vulnerability of the GNOME Remote Desktop remote connection package, related to the provision of data elements for erroneous sessions, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GNOME Remote Desktop remote connection package lies in the provision of a data element for erroneous sessions. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the AddReportResult method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the AddReportResult method in the SolarWinds Access Rights Manager ARM access control software is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability of Siemens LOGO programmable logic controllers’ built-in software relates to the use of cryptographic algorithms that contain defects, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Siemens LOGO programmable logic controllers’ built-in software is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow an attacker operating remotely to gain access to protected information...