Subscription Health Dashboard Update: Optimize Deployments and Identify Issues

For VM teams navigating the complex realm of cybersecurity tools, ensuring deployment health is paramount. Swift methods are required to pinpoint issues amidst complexity. Challenges such as duplicate entries, ghost hosts, and decommissioned devices can obstruct these views, hindering data...

Description of the security update for Office 2016: August 13, 2024 (KB5002570)

None None...

org.jenkins-ci.main:jenkins-test-harness (1.570), org.jenkins-ci.main:jenkins-war (1.570) +6 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.570)

org.jenkins-ci.main:jenkins-core MAVEN version 1.570 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.570 - org.jenkins-ci.main:jenkins-war 1.570 -...

CVE-2024-42347

Affects matrix-react-sdk (Matrix web client component). A malicious homeserver could manipulate a user’s account data to enable URL previews in end-to-end encrypted rooms, causing URLs from encrypted messages to be sent to the server. This is mitigated by upgrading to matrix-react-sdk version 3.1...

CVE-2024-41820 Cluster-level privilege escalation in kubean

Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has verbs of resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the...

Project-level Deploy Token Handler adminPushRules Deployment Token Creation

The vulnerability of the adminPushRules function in the Project-level Deploy Token Handler component of the software platform based on Git for collaborative code development on GitLab is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to crea...

CVE-2024-7458 elunez eladmin Database Management/Deployment Management upload path traversal

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...

CVE-2024-7458 elunez eladmin Database Management/Deployment Management upload path traversal

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...

CVE-2024-7458

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...

CVE-2024-7458 elunez eladmin Database Management/Deployment Management upload path traversal

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...

CVE-2024-7458

CVE-2024-7458 affects elunez eladmin up to version 2.7. The vulnerability arises from path traversal via the file argument in the endpoints /api/deploy/upload and /api/database/upload within Database Management/Deployment Management. This can lead to accessing files outside the intended directory...

Exploit for Special Element Injection in Google Android

EvilDroid: Automated Exploit for CVE-2024-0044 EvilDroid...

ELADMIN security vulnerabilities

ELADMIN is a backend management system for elunez individual developers. A security vulnerability exists in ELADMIN 2.7 and earlier versions, which stems from some unknown handling of files in the component database management/deployment management, where manipulation of parameter files can lead ...

CVE-2024-7458: Path Traversal: 'dir/../../filename'

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversa...

Education in Secure Software Development

The Linux Foundation and OpenSSF released a report on the state of education in secure software development. …many developers lack the essential knowledge and skills to effectively implement secure software development. Survey findings outlined in the report show nearly one-third of all...

Rockwell Automation Logix Controllers

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : ControlLogix, GuardLogix, and 1756 ControlLogix I/O Modules Vulnerability : Unprotected Alternate Channel 2. RISK EVALUATION Successful exploitation of this...

Issue while deploying Session Recording servers from within the Cloud

Error "The Current machine does not have sysadmin access" while deploying Session Recording servers from within the Cloud...

CVE-2024-41799 tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via...

Octopus Server security vulnerabilities

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. A security vulnerability exists in Octopus Server that stems from the fact that under certain circumstances, sensitive variables may be printed in plaintext in the task log...

JetBrains TeamCity Information Disclosure Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool that is primarily used to automate the software build, test, and deployment process. An information disclosure vulnerability exists in JetBrains TeamCity, which stems from a "password"-type parameter that can be disclosed to build logs und...