CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

CVE-2023-20060

A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface does not...

CVE-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially...

CVE-2022-45157 Exposure of vSphere's CPI and CSI credentials in Rancher

A vulnerability has been identified in the way that Rancher stores vSphere's CPI Cloud Provider Interface and CSI Container Storage Interface credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext...

GHSA-6X36-QXMJ-RV4P .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-43499 | .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications t...

Description of the security update for Office 2016: November 12, 2024 (KB5002642)

None None...

Description of the security update for SharePoint Server Subscription Edition: November 12, 2024 (KB5002651)

None None...

CVE-2024-38826

Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller. The Cloud Foundry project recommends upgrading the following releases: Upgrade capi release version to 1.194.0 or...

CVE-2024-38826 CVE-2024-38826 Cloud Controller Denial of Service Attack

Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller. The Cloud Foundry project recommends upgrading the following releases: Upgrade capi release version to 1.194.0 or...

CVE-2024-38826

CVE-2024-38826 concerns Cloud Foundry Cloud Controller. Authenticated users can upload specially crafted files to leak server resources, enabling a potential denial-of-service against the Cloud Controller. Affected components include Cloud Foundry Capi Release versions before 1.194.0 and cf-deplo...

PT-2024-28234 · Cloud Foundry · Cf-Deployment +1

Name of the Vulnerable Software and Affected Versions: Cloud Foundry Capi Release versions prior to 1.194.0 Cloud Foundry cf-deployment versions prior to v44.1.0 Description: The issue allows authenticated users to upload specifically crafted files, potentially leading to a denial of service atta...

Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

A vulnerability in the configuration of the CI/CD application deployment and continuous integration system JetBrains TeamCity allows a hacker to execute cross-site scripting attacks.

The vulnerability in the configuration of CI/CD system’s backup settings in JetBrains TeamCity exists due to the lack of measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Release Information for Proxmox Virtual Environment Plug-In v12.1.1.1024

Requirements This update to the Proxmox Virtual Environment Plug-In for Veeam Backup & Replication requires: Veeam Backup & Replication build 12.2.0.334 You can check the build number in the Veeam Backup & Replication Console's Main Menu ≡ under Help About. Proxmox Virtual Environment Plug-In for...

Critical Flaws in Ollama AI Framework Could Enable DoS, Model Theft, and Poisoning

Cybersecurity researchers have disclosed six security flaws in the Ollama artificial intelligence AI framework that could be exploited by a malicious actor to perform various actions, including denial-of-service, model poisoning, and model theft. "Collectively, the vulnerabilities could allow an...

New Teams Deployment Guidance for App Layering or User Personalization Layer(UPL)

Microsoft Teams 2.x has changed its installation method and now installs under C:\Program Files\WindowsApps. Based on those changes this article provides the specific steps for the deployment of the Teams 2.x in an App LayeringAL or User Personalization LayerUPL environment. For the most current...

Ollama 安全漏洞

Ollama is an Ollama open source large-scale language model that can be started and run locally. A security vulnerability exists in Ollama versions prior to 0.1.46, which stems from a path traversal vulnerability in the api/push routing, leading to the exposure of files on the deployment server...

JetBrains YouTrack Cross-Site Scripting Vulnerability

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. JetBrains YouTrack suffers from a cross-site scripting...

CVE-2024-51243

The eladmin v2.7 and before contains a remote code execution RCE vulnerability that can control all application deployment servers of this management system via DeployController.java...

PT-2024-30544 · Snowflake · Snowflake Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Snowflake JDBC driver versions = 3.2.6 and = 3.2.6 and = 3.19.1, upgrade to version 3.20.0 or later as soon as possible to fix the incorrect security setting. As a temporary workaround, consider avoiding the use of the CLIENT ENCRYPTION KEY...