CVE-2023-27587

ReadtoMyShoe (RTMS) is affected by CVE-2023-27587. When an article-adding error occurs, the TTS request URL may leak the Google Cloud API key in the full URL. A PoC demonstrates the leaked key in the error output; the issue is tied to pre-8533b01 behavior. The advisory notes that this has been pa...

CVE-2023-27587: Generation of Error Message Containing Sensitive Information

ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27901...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27903 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27903...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27904...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27902 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27902...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27900 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27900...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2023-27899...

A Bootiful Podcast: Google Cloud Java Advocate Aaron Wanjala

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Google Cloud Java advocate Aaron Wanjala @ AaronMDubya about Spring Framework for Google Cloud...

Internet Bug Bounty: CVE-2023-25692: Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service and Remote Command Execution

An improper input validation vulnerability was discovered in the Apache Airflow Google Provider, affecting versions before 8.10.0. Attackers could modify existing connection configuration information to execute malicious commands or create arbitrary files, leading to denial of service...

Internet Bug Bounty: Apache Airflow Google Cloud Sql Provider Remote Command Execution

An improper input validation vulnerability was discovered in Apache Airflow Google Provider before version 8.10.0, which could allow an attacker to execute remote commands on the victim's machine by modifying the existing connection configuration information. The vulnerability was discovered by X...

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks

Malicious actors can take advantage of "insufficient" forensic visibility into Google Cloud Platform GCP to exfiltrate sensitive data, a new research has found. "Unfortunately, GCP does not provide the level of visibility in its storage logs that is needed to allow any effective forensic...

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks

Malicious actors can take advantage of "insufficient" forensic visibility into Google Cloud Platform GCP to exfiltrate sensitive data, a new research has found. "Unfortunately, GCP does not provide the level of visibility in its storage logs that is needed to allow any effective forensic...

USN-5917-1: Linux kernel vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

CVE-2023-25691 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

CVE-2023-25691 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

CVE-2021-42135

A flaw was found in the HashiCorp vault. Affected versions may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. In some situations, users may have more privileges than intended...

PT-2023-1501 · Fortinet · Fortiauthenticator +2

Name of the Vulnerable Software and Affected Versions: FortiGate versions 6.0.0 through 6.0.13 FortiGate versions 6.2.0 through 6.2.9 FortiGate versions 6.4.0 through 6.4.1 FortiAuthenticator version 5.5.0 FortiAuthenticator versions 6.0 FortiAuthenticator versions 6.1 Description: A clear text...

SUSE CVE-2018-12907

In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google, because there is no validation of a URL field received from the Google Cloud Storage API server, aka a "RESTLESS" issue...

SUSE CVE-2018-16477

A bypass vulnerability in Active Storage = 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as...