The initialize() function can be called first by an attacker

Lines of code Vulnerability details Impact In Delegation.sol the initialize function sets the owner of the contract and can only be called once. The problem is that an attacker can monitor the blockchain byte code and call the initialize function first automatically before the protocol has a chan...

Security Bulletin: Predictive Maintenance and Quality and Predictive Maintenance Insights is vulnerable to arbitrary code execution and denial of service due to Apache Log4j (CVE-2021-45105, CVE-2021-45046, CVE-2021-4104, CVE-2021-44832).

Summary IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises are vulnerable to Apache Log4j CVE-2021-45105, CVE-2021-45046, CVE-2021-4104, CVE-2021-44832 due to multiple components using Apache Log4j for logging. This has been addressed in each of the components;...

US Government sets forth Zero Trust architecture strategy and requirements

To help protect the United States from increasingly sophisticated cyber threats, the White House issued Executive Order EO 14028 on Improving the Nation’s Cybersecurity, which requires US Federal Government organizations to take action to strengthen national cybersecurity.1 Section 3 of EO 14028...

CVE-2021-3557

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.7.43 security update

Red Hat OpenShift Container Platform release 4.7.43 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a...

PT-2022-10470 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: argocd affected versions not specified Description: A flaw was found in argocd, allowing any unprivileged user to deploy argocd in their namespace. With the created ServiceAccount argocd-argocd-server, the unprivileged user can read all...

GHSA-VFP4-XX6M-7VF6 Cryptographic Issues in ECK

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

Cloudsploit - Cloud Security Posture Management (CSPM)

Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $ docker run cloudsploit:0.0.1 -h $ docker run -...

Showmax: Cross-origin resource sharing

A misconfiguration on recent deployment caused CORS headers not to be set on the https://stories.showmax.com service. While no customer data could be exposed via this channel, it's a good practice to set CORS headers if possible. Please note that CORS is actually out-of-scope of our program since...

Description of the security update for Office Web Apps Server 2013: February 8, 2022 (KB5002149)

None None...

Description of the security update for Office 2013: February 8, 2022 (KB5002146)

Description of the security update for Office 2013: February 8, 2022 KB5002146 Summary This security update resolves a Microsoft Office graphics remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2022-22003. Note: To...

Description of the security update for SharePoint Enterprise Server 2016: February 8, 2022 (KB5002136)

None None...

Description of the security update for Office Online Server: February 8, 2022 (KB5002133)

None None...

The vulnerability of AppX Deployment Extensions for Windows operating systems stems from deficiencies in access control, allowing attackers to escalate their privileges.

The vulnerability of AppX Deployment Extensions in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

New Argo CD Bug Could Let Hackers Steal Secret Info from Kubernetes Apps

Users of the Argo continuous deployment CD tool for Kubernetes are being urged to push through updates after a zero-day vulnerability was found that could allow an attacker to extract sensitive information such as passwords and API keys. The flaw, tagged as CVE-2022-24348 CVSS score: 7.7, affects...

PT-2023-2333

Name of the Vulnerable Software and Affected Versions Minio versions prior to RELEASE.2023-03-20T20-16-18Z Minio version 2022.02.01-alt1 Minio version 2022.12.07-alt1 Minio version 2023.05.18-alt1 Minio version 2023.10.16-alt1 Minio version 2023.03.24-alt1 Description MinIO is a Multi-Cloud Objec...

JDK: unspecified vulnerability fixed in 8u311 (Deployment)

Vulnerability in the Java SE product of Oracle Java SE component: Deployment. The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require...

ROS-20220125-06

The vulnerability in the Flatpak deployment, package management utility is due to the application not properly checks whether the permissions displayed to the user for the application during installation correspond to the actual permissions granted to the application at runtime. during installati...

Code injection

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-...

FACT - A Tool To Collect, Process And Visualise Forensic Data From Clusters Of Machines Running In The Cloud Or On-Premise

FACT is a tool to collect, process and visualise forensic data from clusters of machines running in the cloud or on-premise. Deployment For a basic single-node deployment, we recommend using Docker and Docker Compose. First, read docker-compose.yaml for configuration and requirements. Then, start...