GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that originates from allowing an authenticated attacker to craft a Remote Function Call RFC request to a restricted destination, which could be used to...

CVE-2024-37046

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data. We have already fixed the...

CVE-2024-52582

Cachi2 (open source CLI) is affected up to version 0.13.x; when an unhandled exception occurs, the tool logs function locals, potentially exposing secrets in CI/build logs. Version 0.14.0 includes a patch to fix this. No other exploit details are provided in the documents. Remediation: upgrade to...

The vulnerability of Adobe After Effects’ video and dynamic image editing software arises from operations that go beyond buffer boundaries in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the execution of operations beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

CVE-2024-30128

HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information...

MGASA-2024-0294 Updated expat packages fix security vulnerabilities

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer. CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms where UINTMAX equals SIZEMAX...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication procedures. This allows attackers to bypass security restrictions and expose sensitive information.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions and expose sensitive...

PYSEC-2024-266

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

CVE-2024-32931 exacqVison - Token Disclosed in URL

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

GHSA-Q22Q-2RRF-M27P Mattermost allows unsolicited invites to expose access to local channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

Malicious code in jqtools-toolbox-expose (npm)

The package contains code to exfiltrate user and host information to an oastify domain. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf8ecc5384976555e101e147d0456707c86467e52647ed0bdbc91bc47639356a The OpenSSF Package Analysis project identified...

MAL-2024-7784 Malicious code in jqtools-toolbox-expose (npm)

The package contains code to exfiltrate user and host information to an oastify domain. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf8ecc5384976555e101e147d0456707c86467e52647ed0bdbc91bc47639356a The OpenSSF Package Analysis project identified...

The vulnerability of the ODBC library for UNIX systems, related to the pointer displacement beyond the allocated memory range, allows attackers to access confidential data and also trigger a service failure.

The vulnerability of the ODBC library for UNIX systems is related to the pointer shifting beyond the allocated memory range. Exploiting this vulnerability allows an attacker to gain access to confidential data and also cause service failures...

CVE-2024-1913

An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific...

PT-2024-26346 · Gutenify · Gutenify

Name of the Vulnerable Software and Affected Versions: Gutenify versions 1.4.0 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. Recommendations: For versions 1.4.0 and earlier, update to a version that contains a fix for this issue,...

PT-2024-23171 · Brocade · Brocade Sannav Ova

Name of the Vulnerable Software and Affected Versions: Brocade SANnav OVA versions prior to 2.3.1 Brocade SANnav OVA version 2.3.0a Description: The issue is related to an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileg...

PT-2024-3091

Name of the Vulnerable Software and Affected Versions Airflow versions 2.7.0 through 2.8.4 Description The issue is related to insufficient protection of internal data, allowing an authenticated user to access sensitive provider configuration via the "configuration" UI page when the...

Apple iOS 和 iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 16.7.3 and iPadOS version 16.7.3, which originates from an applicatio...