Google Fixes GCP Composer Flaw That Could've Led to Remote Code Execution

A now-patched critical security flaw impacting Google Cloud Platform GCP Composer could have been exploited to achieve remote code execution on cloud servers by means of a supply chain attack technique called dependency confusion. The vulnerability has been codenamed CloudImposer by Tenable...

SUSE SLES15: libprotobuf-lite25_1_0 / libprotobuf25_1_0 / libprotoc25_1_0 / etc (SUSE-SU-SUSE-RU-2024:1637-3)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2024:1637-3 advisory. - Add python311 cloud services packages and dependencies jscPED-7987, jscPED-6697 - Bellow 5 binaries Obsolete the python3.6...

SUSE-RU-2024:1637-3 Recommended update for google-cloud SDK

This update for google-cloud SDK fixes the following issues: - Add python311 cloud services packages and dependencies jscPED-7987, jscPED-6697 - Bellow 5 binaries Obsolete the python3.6 counterpart: python311-google-resumable-media python311-google-api-core python311-google-cloud-storage...

USN-7003-2: Linux kernel vulnerabilities

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service system crash. CVE-2024-40902 Several security issues were discovered in the Linux kernel. An attacker could...

PT-2024-9768 · Google +2 · Gcs +2

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-techdocs-backend versions prior to 1.10.13 Description: The issue is related to the Backstage platform, an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs, it is...

MAL-2025-4666 Malicious code in proto-google-cloud-dlp-v2beta1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d21bb408ed0e178e23e5b4face7188968fd711ea7ceab009b9d04e6a508740d Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in proto-google-cloud-dlp-v2beta1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d21bb408ed0e178e23e5b4face7188968fd711ea7ceab009b9d04e6a508740d Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

com.github.nbbrd.sdmx-dl:sdmx-dl-grpc (=3.0.0-beta.12), com.github.rebue.wheel:wheel-vertx (>=2.2.9 <=2.2.12) +173 more potentially affected by CVE-2024-8391 via io.vertx:vertx-grpc-server (>=4.3.0 <=4.5.1)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =2.2.9, =0.30.0, =0.21.0, =2.8.0, =0.2.0, =0.0.7, =0.0.7, =0.0.7, =2.7.0, =2.7.0, =2.7.0, =1.0.4, =1.0.4, =1.3.0, =2.7.0 and more Source cves: CVE-2024-8391 Source advisory: OSV:GHSA-G76F-GJFX-4RPRhttps://vulners.com/osv/OSV:GHSA-G...

USN-6972-1: Linux kernel vulnerabilities

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service system crash. CVE-2024-22099 It was discovered that a race condition existed in th...

CVE-2024-32928

The libcurl CURLOPTSSLVERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through...

CVE-2024-32928

The libcurl CURLOPTSSLVERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through...

CVE-2024-32928

The libcurl CURLOPTSSLVERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through...

CVE-2024-32928

CVE-2024-32928 relates to libcurl where CURLOPT_SSL_VERIFYPEER was disabled on a subset of requests from Nest production devices, enabling potential MITM attacks on traffic to Google Cloud Services. Connected documents confirm the issue is tied to Nest devices and libcurl behavior, with some sour...

CVE-2024-32928

The libcurl CURLOPTSSLVERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through...

Google Nest 安全漏洞

Google Nest is a smart home product from the American company Google Google. Google Nest suffers from a security vulnerability that stems from the fact that some of the requests sent are disabled, which makes any request to Google Cloud Services from a host routed through traffic potentially...

PT-2024-24983 · Google · Nest

Name of the Vulnerable Software and Affected Versions: Nest production devices affected versions not specified Description: The issue concerns the libcurl CURLOPT SSL VERIFYPEER option being disabled on a subset of requests made by Nest production devices. This enabled a potential man-in-the-midd...

USN-6927-1: Linux kernel vulnerabilities

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. CVE-2022-38096 Gui-Dong Han discovered that the...

USN-6924-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM SCMI message protocol; - InfiniBand drivers; - TTY drivers; - TLS protocol; CVE-2024-26584, CVE-2024-36016,...

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Cybersecurity researchers have discovered a malicious package on the Python Package Index PyPI repository that targets Apple macOS systems with the goal of stealing users' Google Cloud credentials from a narrow pool of victims. The package, named "lr-utils-lib," attracted a total of 59 downloads...

Malicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 73ea760146181d2911e0823c121502506892b2e63d3fc20d6281fb2c86e03de8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...