pdoc Security Vulnerabilities

pdoc is an API documentation for Python projects open-sourced by mitmproxy. A security vulnerability exists in pdoc prior to version 14.5.1, which stems from the pdoc --math command generating a link to a document that points to a CDN that is no longer secure...

Malicious code in active-delivery (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6397 Malicious code in active-delivery (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in action-mailer_cache_delivery (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wp-delivery-hero-core-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 626c10f0486b04cda2d813bc50241e0676d4ab679f376a6922b10d61c961dfcb The OpenSSF Package Analysis project identified 'wp-delivery-hero-core-v2' @ 2.2.1 npm as malicious. It is considered malicious because: - The...

Malicious code in delivery-promise (npm)

--- -= Per source details. Do not edit below this line.=-...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that originates from a problem or error in the server that prevents it from processing requests or providing services properly...

A week in security (June 17 – June 23)

Last week on Malwarebytes Labs: Microsoft Recall delayed after privacy and security concerns Almost everything you always wanted to know about cybersecurity, but were too afraid to ask, with Tjitske de Vries: Lock and Code S05E13 43% of couples experience pressure to share logins and locations,...

PT-2024-5728 · Citrix · Citrix Virtual Delivery Agent For Windows +2

Name of the Vulnerable Software and Affected Versions: Citrix Virtual Delivery Agent for Windows affected versions not specified Description: The issue is related to insecure privilege management in the Virtual Delivery Agent for Windows component of Citrix Virtual Apps and Desktops and Citrix...

What is DevSecOps and Why is it Essential for Secure Software Delivery?

Traditional application security practices are not effective in the modern DevOps world. When security scans are run only at the end of the software delivery lifecycle either right before or after a service is deployed, the ensuing process of compiling and fixing vulnerabilities creates massive...

The vulnerability of the Siemens RUGGEDCOM CROSSBOW secure access control system allows a intruder to execute arbitrary code.

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the deficiencies of its authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created malware files from a remote location...

Grandoreiro Banking Trojan Hits Brazil as Smishing Scams Surge in Pakistan

Pakistan has become the latest target of a threat actor called the Smishing Triad, marking the first expansion of its footprint beyond the E.U., Saudi Arabia, the U.A.E., and the U.S. "The group's latest tactic involves sending malicious messages on behalf of Pakistan Post to customers of mobile...

BIT-ARGO-CD-2024-36106 Argo CD allows authenticated users to enumerate clusters by name

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. Thi...

BIT-ARGO-CD-2024-37152 Unauthenticated Access to sensitive settings in Argo CD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...

CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...

CVE-2024-36106

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. Thi...

A10 Networks Thunder ADC Security Vulnerability

A10 Networks Thunder ADC is an application distribution/load balancer from A10 Networks that provides high performance. A10 Networks Thunder ADC has a security vulnerability that stems from the presence of an incorrect local elevation of privilege vulnerability that allows a local attacker to...

Uploadcare File Uploader and Adaptive Delivery (beta) <= 3.0.11 - Cross-Site Request Forgery

Description The Uploadcare File Uploader and Adaptive Delivery beta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.11. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticate...

The vulnerability of the Continuous Integration and Application Delivery system (CI/CD) JetBrains TeamCity lies in the lack of measures taken to protect the structure of web pages. This allows attackers to perform cross-page script attacks.

The vulnerability of the CI/CD application integration and delivery system of JetBrains TeamCity is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to deficiencies in the authentication process, allows attackers to escalate their privileges.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...