CVE-2024-12236 Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration

A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further...

CVE-2024-12236

Vertex Gemini API leaks data if a crafted fileUri for image input is used with VPC Service Controls, potentially bypassing the VPC-SC perimeter. Google Cloud fixed this by returning an error when a media file URL is specified in the fileUri parameter with VPC-SC enabled; other cases are unaffecte...

This Week in Spring - November 19th, 2024

Hi, Spring fans! How are you? Can you believe we're already staring at the end of the month? It's that time of the year when we see new releases, and the new releases reflect that frenzy! Soon: Spring Boot 3.4.0! Are you updated? Make sure you're updated! Remember: Spring projects leave open sour...

Google Cloud to Enforce Multi-Factor Authentication by 2025 for All Users

Google's cloud division has announced that it will enforce mandatory multi-factor authentication MFA for all users by the end of 2025 as part of its efforts to improve account security. "We will be implementing mandatory MFA for Google Cloud in a phased approach that will roll out to all users...

The vulnerability of the Google Cloud Migrate data and application migration software, related to incorrect default permissions, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Google Cloud Migrate data and application migration software is related to incorrect default permissions. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

USN-7073-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Watchdog drivers; - Netfilter; - Memory management; - Network traffic control; CVE-2024-27397, CVE-2024-38630,...

CVE-2024-9858

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the...

CVE-2024-9858

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the...

CVE-2024-9858 Insecure user permissions in Google Cloud Migrate to Containers for Windows

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the...

CVE-2024-9858 Insecure user permissions in Google Cloud Migrate to Containers for Windows

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the...

CVE-2024-9858

CVE-2024-9858 affects Google Cloud Migrate to Containers for Windows (versions 1.1.0–1.2.2). The root cause is an insecure default local user, m2cuser, created with administrator privileges. If the analyze or generate workflow is interrupted or the local user is not deleted, this user could be ex...

Google Cloud Migrate 安全漏洞

Google Cloud Migrate is a cloud architecture center of Google, Inc USA. A security vulnerability exists in Google Cloud Migrate versions 1.1.0 through 1.2.2 that stems from the presence of insecure default user permissions...

CVE-2024-8912

CVE-2024-8912 describes an HTTP Request Smuggling vulnerability in Looker. The issue affects customer-hosted Looker instances, which must be upgraded to the latest supported versions to be protected. Looker on Google Cloud core was reported as vulnerable but mitigated with no signs of exploitatio...

Malicious code in gcp-monitor-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8ac49f0f48f0a8f3b5ab417aeeeac247298e9ab4f211f88aadcca93bc624e58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-7334 · Google · Google Cloud Migrate To Containers

Name of the Vulnerable Software and Affected Versions: Google Cloud Migrate to Containers versions 1.1.0 through 1.2.2 Description: The issue is related to an insecure default user permission in Google Cloud Migrate to containers. A local user m2cuser is created with administrator privileges,...

[SECURITY] Fedora 41 Update: python-gcsfs-2024.9.0-1.fc41

Pythonic file-system for Google Cloud Storage...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.17.0 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Enhancing Cloud-Native Security: Qualys Introduces Scanning for Container-Optimized OS in Google Kubernetes Engine

As organizations move from traditional workloads to containerized environments, they encounter new security challenges. Containers bring added complexity that traditional security tools often struggle to manage, largely because of their transient nature and the shared responsibility between the...

USN-7021-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - BTRFS file system; - F2FS file system; - GFS2 file system; - BPF subsystem; - Netfilter; - RxRPC...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in versions prior to Backstage 1.10.13 that stems from the possibility of accessing the contents of an entire storage bucket when using AWS S3 or GCS...