17765 matches found
CVE-2024-5891
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, ...
Security Bulletin: IBM® Db2® NSE (Net Search Extender) is affected by a vulnerability in the open source Expat library. (CVE-2024-28757)
Summary IBM® Db2® NSE Net Search Extender is affected by a vulnerability in the open source Expat library. Vulnerability Details CVEID:CVE-2024-28757 DESCRIPTION: libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity XXE...
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
...
CGA-5RG5-HMWM-F62R
Bulletin has no description...
CGA-7PGC-PXCM-6856
Bulletin has no description...
CGA-444X-M3PV-8G5R
Bulletin has no description...
CGA-9C4W-VHVV-94Q4
Bulletin has no description...
CVE-2024-5742
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...
Deciphering LilacSquid’s Strategies for Long-Term Data Theft
...
CGA-9R6J-R9JM-49C8
Bulletin has no description...
CGA-75WG-2HG6-XP3W
Bulletin has no description...
CGA-639V-5G84-X4JC
Bulletin has no description...
CGA-VJM9-2PC6-G66Q
Bulletin has no description...
CGA-83JM-7G5V-4255
Bulletin has no description...
CGA-2Q89-GF3G-6W5V
Bulletin has no description...
GHSA-5Q6C-FFVG-XCM9 Remote code execution in mlflow
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command 'Command Injection' within the mlflow.data.httpdatasetsource.py module. Specifically, when loading a dataset from a source URL with an HTTP...
Argo-cd authenticated users can enumerate clusters by name
Impact It’s possible for authenticated users to enumerate clusters by name by inspecting error messages: $ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H "Authorization: Bearer $token" "error":"permission denied: clusters, get, , sub: alice, iat:...
Security Bulletin: Multiple security vulnerabilities Affect IBM WebSphere Application Server Liberty shipped with IBM OpenPages
Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in multiple security bulletins. These products have addressed the applicable CVEs...