BIT-PARSE-2021-39187 Crash server with query parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

BIT-PARSE-2022-31089 Invalid file request can crashe parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability...

BIT-PARSE-2022-31112 Protected fields exposed via LiveQuery in parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client respons...

BIT-PARSE-2022-41879 Parse Server subject to Prototype pollution via Cloud Code Webhooks

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server...

BIT-PARSE-2023-46119 Parse Server may crash when uploading file without extension

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1...

BIT-MYSQL-SHELL-2022-21535

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell: General/Core Client. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Shell executes to compromise...

BIT-MYSQL-SHELL-2022-21555

Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL component: Shell: GUI. Supported versions that are affected are 1.1.8 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Shell for VS Code executes to...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kwok, kubernetes-csi-external-resizer, supercronic, vertical-pod-autoscaler, kpt, kubeflow, spire-server, grpcurl, certificate-transparency, hugo, vault-k8s, cloudflared, kube-fluentd-operator, golangci-lint, temporal-ui-server, hugo-extended,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: kwok, shfmt, aws-flb-cloudwatch, aws-flb-firehose, kubernetes-csi-external-resizer, supercronic, vertical-pod-autoscaler, kpt, docker-credential-ecr-login, grpcurl, vault-k8s, cni-plugins, golangci-lint, temporal-ui-server, kube-rbac-proxy, ytt, cert-exporter, flux,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: kwok, shfmt, aws-flb-cloudwatch, aws-flb-firehose, kubernetes-csi-external-resizer, supercronic, vertical-pod-autoscaler, kpt, docker-credential-ecr-login, grpcurl, vault-k8s, cni-plugins, golangci-lint, temporal-ui-server, kube-rbac-proxy, ytt, cert-exporter, flux,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: kwok, shfmt, aws-flb-cloudwatch, aws-flb-firehose, kubernetes-csi-external-resizer, supercronic, vertical-pod-autoscaler, kpt, docker-credential-ecr-login, grpcurl, vault-k8s, cni-plugins, golangci-lint, temporal-ui-server, kube-rbac-proxy, ytt, cert-exporter, flux,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: kwok, shfmt, aws-flb-cloudwatch, aws-flb-firehose, kubernetes-csi-external-resizer, supercronic, vertical-pod-autoscaler, kpt, docker-credential-ecr-login, grpcurl, vault-k8s, cni-plugins, golangci-lint, temporal-ui-server, kube-rbac-proxy, ytt, cert-exporter, flux,...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 3 (6.0.1-89)

This update provides stability improvements. Vulnerability id: VSTOR-82695 Deploying a Kubernetes cluster may take longer than expected. Vulnerability id: VSTOR-82730 Restarting libvirtd causes EFI VMs to reboot...

Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure

U.S. cybersecurity and intelligence agencies have warned of Phobos ransomware attacks targeting government and critical infrastructure entities, outlining the various tactics and techniques the threat actors have adopted to deploy the file-encrypting malware. "Structured as a ransomware as a...

CISA, FBI, and MS-ISAC Release Advisory on Phobos Ransomware

Today, CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC released a joint Cybersecurity Advisory CSA, StopRansomware: Phobos Ransomware, to disseminate known tactics, techniques, and procedures TTPs and indicators of compromise IOCs...

Delta Electronics CNCSoft-B

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Delta Electronics Equipment : CNCSoft-B Vulnerability : Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3...

kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c

A flaw was found in the Linux kernel Direct Rendering Infrastructure DRI subsystem in which a use-after-free can be caused when a user triggers a race condition between a nonblocking atomic commit and a driver unload. A local user could use this flaw to crash the system or potentially escalate...

Unmasking Doppelgänger: Russia’s Disinformation Campaign Revealed

Summary: Doppelgänger, a suspected Russia-aligned influence operation network targeting German audiences with propaganda and disinformation, potentially aiming to sway opinions ahead of elections. Doppelgänger employs coordinated social media activities and a dynamic infrastructure to maximize it...

The vulnerability of the monitoringwizard.php file, a monitoring tool for IT infrastructure, allows a malicious actor to execute arbitrary SQL queries.

The vulnerability of the monitoringwizard.php file, a tool for monitoring IT infrastructure, relates to the possibility of embedding commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the /usr/local/nagios/bin/npcd component, a monitoring tool for IT infrastructure, allows a attacker to elevate their privileges to the root level.

The vulnerability of the /usr/local/nagios/bin/npcd component of the Nagios XI IT infrastructure monitoring tool exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the root...