JetBrains TeamCity elevation of privilege vulnerability (CNVD-2023-62626)

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A privilege vulnerability exists in JetBrains...

OESA-2023-1451 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbinddpamauthcrap.c. When performing NTLM authentication, the client replies to cryptographic challenges back...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to denial of service (CVE-2023-24971)

Summary IBM B2B Advanced Communications has addressed a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-24971 DESCRIPTION: IBM B2B Advanced Communications could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. CVSS Base...

Security Bulletin: IBM B2B Advanced Communication is vulnerable to cross-site scripting (CVE-2023-22595)

Summary IBM B2B Advanced Communications has addressed a cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2023-22595 DESCRIPTION: IBM B2B Advanced Communication is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U...

Cloudflare Public Bug Bounty: Permanent CASB Integration Takeover due to Improper Access Controls+Confused Deputy Problem

A security vulnerability was discovered in Cloudflare's Cloud Access Security Broker CASB integration, allowing potential unauthorized access to sensitive information. The vulnerability, known as the "confused deputy problem," affected a limited set of integrations. Cloudflare promptly addressed...

CVE-2023-38493

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

Cross site request forgery (csrf)

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

CVE-2023-38493

CVE-2023-38493 affects Armeria (microservice framework) when used with Spring integration. The issue arises in how matrix variables in paths are handled when Armeria decorates or forwards requests to Spring controllers via TomcatService or JettyService, potentially allowing bypass of the authoriz...

CVE-2023-38493 Paths contain matrix variables bypass decorators

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

Paths contain matrix variables bypass decorators

Impact Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. In this situation, the Armeria decorators might not invoked because of the matrix variables. Let's see the...

CVE-2023-39174

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers...

CVE-2023-39175

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible...

CVE-2023-39174

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers...

CVE-2023-39175

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible...

Information disclosure

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers...

CVE-2023-39175

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible...

CVE-2023-39175

Summary: CVE-2023-39175 pertains to JetBrains TeamCity prior to 2023.05.2, where a reflected XSS vulnerability exists via the GitHub integration. Affected products/versions: TeamCity servers running a version older than 2023.05.2. Root cause (as stated): Reflected cross-site scripting through the...

CVE-2023-39175

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible...

CVE-2023-39174

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers...

PT-2023-26830 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05.2 Description: The issue concerns a reflected XSS vulnerability via GitHub integration. This allows for potential attacks through malicious input that is reflected back to the user, potentially...