CVE-2024-36536

CVE-2024-36536 affects fabedge v0.8.1 due to insecure permissions that let attackers access sensitive data and escalate privileges by obtaining a service account token. Red Hat, OSV and related advisories corroborate the same issue across fabedge components. Impact is high: confidentiality, integ...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27055 · Meshery · Meshery

Name of the Vulnerable Software and Affected Versions: meshery version 0.7.51 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For meshery version 0.7.51, update to a...

CVE-2024-36539

In Contour 1.28.3, insecure permissions on the service account allow attackers to access the token and escalate privileges, enabling sensitive data access. Affects Contour (Kubernetes ingress controller) v1.28.3; root cause is improper token permissions. Documented impact: high confidentiality, i...

PT-2024-27059 · Contour · Contour

Name of the Vulnerable Software and Affected Versions: contour version 1.28.3 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For contour version 1.28.3, update the...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-29070 Apache StreamPark: session not invalidated after logout

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users...

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data, thereby increasing their privileges.

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data, thereby...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2024-2600)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.12+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2600 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability of the Servlet component of the Oracle Reports Developer reporting software allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the Servlet component in the Oracle Reports Developer reporting software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

Apache StreamPark 代码问题漏洞

Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. Apache StreamPark versions prior to 2.1.4 suffer from a session expiration insufficiency vulnerability, which stems from the fact that the session is not expired after logging...

The vulnerability of the AddReportResult method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the AddReportResult method in the SolarWinds Access Rights Manager ARM access control software is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability of the GNOME Remote Desktop remote connection package, related to the provision of data elements for erroneous sessions, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GNOME Remote Desktop remote connection package lies in the provision of a data element for erroneous sessions. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Approvals component of the Oracle Purchasing software, which handles purchase orders, allows a hacker to gain read, modify, add, or delete access to data.

The vulnerability of the Approvals component in the Oracle Purchasing software for processing purchase orders involves insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

The vulnerability of Siemens LOGO programmable logic controllers’ built-in software relates to the use of cryptographic algorithms that contain defects, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Siemens LOGO programmable logic controllers’ built-in software is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow an attacker operating remotely to gain access to protected information...

Important: java-21-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...

The vulnerability of the platform for ensuring the functionality of SAP ABA applications, related to improper code generation management, allows an attacker to gain read and modify access to data or cause service failures.

The vulnerability of the platform for ensuring the functioning of SAP ABA applications is related to improper code generation management. Exploiting this vulnerability can allow a malicious actor to gain read-only access to data or cause service failures...

Important: java-17-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...