Taming API Sprawl: Best Practices for API Discovery and Management

APIs are the backbone of interconnected applications, enabling organizations to innovate, integrate, and scale rapidly. However, as enterprises continue to expand their digital ecosystems, they often encounter a common and complex challenge: API sprawl. Unchecked, API sprawl can lead to increased...

The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper allows a attacker to bypass the authentication process.

The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper is related to the ability to bypass authentication through phising techniques...

Out-of-bounds Write

Overview lightgbm is a gradient boosting framework that uses tree based learning algorithms. Affected versions of this package are vulnerable to Out-of-bounds Write in linkerssocket.cpp, used during initialization of distributed training. An attacker can exploit a race condition to connect to a...

net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events

...

CVE-2024-48950

An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication...

PT-2024-33292 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: An issue was discovered in Logpoint where an endpoint used by Distributed Logpoint Setup was exposed. This exposure allows unauthenticated attackers to bypass CSRF protections and authentication...

RHEL 8 / 9 : Red Hat Service Interconnect 1.4.5 Release (RHSA-2024:4125)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4125 advisory. As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application...

CVE-2024-48950: Missing Authentication for Critical Function

An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.5.0 that stems from an exposed endpoint used by a distributed Logpoint setup, allowing an unauthenticated attacker to bypass CSRF protection and...

German Police Disrupt DDoS-for-Hire Platform dstat[.]cc; Suspects Arrested

German law enforcement authorities have announced the disruption of a criminal service called dstat.cc that made it possible for other threat actors to easily mount distributed denial-of-service DDoS attacks. "The platform made such DDoS attacks accessible to a wide range of users, even those...

Disconf 安全漏洞

Disconf is a distributed configuration management platform by the individual developer Qiqi Liao. A security vulnerability exists in Disconf version 2.6.36, which stems from improper authentication...

[SECURITY] Fedora 41 Update: python-rpyc-6.0.1-1.fc41

RPyC, or Remote Python Call, is a transparent and symmetrical python library for remote procedure calls, clustering and distributed-computing. RPyC makes use of object-proxies, a technique that employs python's dynamic nature, to overcome the physical boundaries between processes and computers, s...

DEBIAN-CVE-2024-49998

In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. The first problem is that lan9303 is...

DDMQ 授权问题漏洞

DDMQ is a distributed messaging middleware open-sourced by China's Dripping DiDi. An authorization issue vulnerability exists in DDMQ version 1.0, which stems from incorrect input manipulation by the console module, which can lead to incorrect authentication...

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request and chose to fragment it an attacker could replace later fragments with their own data bypassing the signature requirements.

...

The vulnerability of the Azure Service Fabric distributed system, related to buffer overflows in dynamic memory, allows attackers to execute arbitrary code.

The vulnerability of the Azure Service Fabric distributed system is related to overflowing buffers in dynamic memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Ransomware Groups Demystified: CyberVolk Ransomware

As part of our ongoing efforts to monitor emerging cyber threats, we have analyzed the activities of CyberVolk, a politically motivated hacktivist group that transitioned into using ransomware and has been active since June 2024. Unlike traditional ransomware groups, CyberVolk initially positione...

The Secret Weakness Execs Are Overlooking: Non-Human Identities

For years, securing a company's systems was synonymous with securing its "perimeter." There was what was safe "inside" and the unsafe outside world. We built sturdy firewalls and deployed sophisticated detection systems, confident that keeping the barbarians outside the walls kept our data and...

cups-browsed: cups-filters: cups-browsed vulnerable to DDoS amplification attack

A flaw was found in cups-browsed. This vulnerability allows an attacker to launch DDoS amplification attacks via an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added...

Infinera Transcend Network Management System 安全漏洞

Infinera Transcend Network Management System Infinera TNMS is a powerful element, network, and service management system from Infinera USA. A security vulnerability exists in Infinera Transcend Network Management System version 19.10.3, which stems from a WebDAV service that allows a low-privileg...