Kurmi Provisioning Suite security vulnerabilities

Kurmi Provisioning Suite is an infrastructure management suite from Kurmi. A security vulnerability exists in Kurmi Provisioning Suite version 7.9.0.33, which stems from the fact that if an X-Forwarded-For header is received during authentication, the Kurmi application logs the potentially spoofe...

PT-2024-9866

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS versions 10.X and 11.X, including Prisma Access. Description: A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious...

Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts

Cybersecurity researchers have flagged two malicious packages that were uploaded to the Python Package Index PyPI repository and came fitted with capabilities to exfiltrate sensitive information from compromised hosts, according to new findings from Fortinet FortiGuard Labs. The packages, named...

Exploit for CVE-2024-9290

CVE-2024-9290 Exploit Tool | Super Backup & Clone Vulnerabilit...

Malicious Package

Overview zebo is a malicious package. This package steals information from the victim by logging keystrokes and taking screen captures, which are exfiltrated to a server under the attacker's control. Remediation Avoid using all malicious instances of the zebo package. References - Fortinet Report...

Malware in dhp-logging-lib

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Sensitive Information Exposure

zhmcclient is vulnerable to Sensitive Information Exposure. The vulnerability is due to the logging of password-like properties in clear text in both the zhmcclient API and HMC logs when specific functions for creating or updating configurations e.g., partitions, LPARs, image activation profiles,...

GitLab Information Disclosure

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the disclosure of information during data transmission. Exploiting this vulnerability can allow unauthorized individuals to gain unauthorized access to protected information by...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

Out-of-bounds Read

Ant-Media-Server is vulnerable to Out-of-bounds Read. The vulnerability is due to insufficient input sanitization in the logging mechanism, allowing user-controllable data, such as identifiers or sensitive information, to be included in log entries without proper filtering or validation. This cou...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

PT-2024-33343

Name of the Vulnerable Software and Affected Versions Keyfactor Remote File Orchestrator versions 2.8 before 2.8.1 Description The issue allows sensitive information to be exposed at the debug logging level, potentially leading to information disclosure. Recommendations For versions 2.8 before...

CVE-2024-49201

The Keyfactor Remote File Orchestrator (also known as remote-file-orchestrator ) version 2.8 before 2.8.1 is vulnerable to an Information Disclosure flaw. The root cause is that sensitive information can be exposed when the system is set to the debug logging level . To remediate this vulnerabilit...

CVE-2024-49201: Insecure Storage of Sensitive Information

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

CVE-2024-49201

Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...

Denial Of Service (DoS)

python-multipart is vulnerable to a Denial of Service DoS. The vulnerability is due to excessive logging and inefficient handling of data when parsing form data. Specifically, line breaks before the first boundary and trailing bytes after the last boundary are processed one byte at a time, emitti...

Malicious code in @saferpay/logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00760b75ef6449f1f4125794bd96880aae15b6a332fb2103a23c849e0d0d01f2 The OpenSSF Package Analysis project identified '@saferpay/logging' @ 5.9.1 npm as malicious. It is considered malicious because: - The package...

CVE-2024-55554

creationtimestamp| type| source ---|---|--- 2024-12-16 21:47:58+00:00| seen| https://infosec.exchange/users/cve/statuses/113664699716476858 2024-12-17 00:03:42+00:00| seen| https://t.me/cvedetector/13043...

OSV-2024-1372 Bad-cast to Assimp::LogStream from Assimp::OptimizeMeshesProcess

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=383595860 Crash type: Bad-cast Crash state: Bad-cast to Assimp::LogStream from Assimp::OptimizeMeshesProcess CallbackToLogRedirector Assimp::DefaultLogger::WriteToStreams...