9728 matches found
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts
Summary A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. Details This vulnerability stems from several gh commands used to clone a repository with...
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
Summary A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. Details go-gh sources authentication tokens from different environment variables depending on the host involved: - GITHUBTOKEN...
CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli
The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...
CVE-2024-53858
The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...
CVE-2024-53859 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace
go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...
DEBIAN-CVE-2024-52337
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...
CVE-2024-52337 Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...
CVE-2024-9929
A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...
CVE-2024-9929
A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...
CVE-2024-9929
A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...
CVE-2024-9929
CVE-2024-9929 affects Hitachi Energy NSD570. The connected sources describe a vulnerability where any authenticated user can access all device logs, exposing login timestamps. Impact is limited to information disclosure of logs; no exploitation details or CVSS-specific vectors are provided beyond...
PT-2024-39944 · Nsd570 · Nsd570
Name of the Vulnerable Software and Affected Versions: NSD570 affected versions not specified Description: A security issue exists that allows any authenticated user to access all device logs, revealing login information with timestamps. Recommendations: At the moment, there is no information abo...
Hitachi Energy NSD570 安全漏洞
The Hitachi Energy NSD570 is a remote protection device from Hitachi, Ltd Hitachi, Japan. It is designed to provide simple commissioning, operation and monitoring of remote protection links. A security vulnerability exists in the Hitachi Energy NSD570 that originates from allowing any authenticat...
sigstore-java 安全漏洞
sigstore-java is a sigstore open source sigstore java client for interacting with sigstore infrastructure. A security vulnerability exists in sigstore-java that stems from sigstore-java's inability to adequately verify that validly signed but mismatched bundles are included in transparent logs...
PT-2024-35702 · Unknown · Sigstore-Java
Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to v1.1.0 Description: The issue is related to insufficient verification in sigstore-java for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log...
Exploit for Improper Access Control in Adobe Coldfusion
CVE-2023-26360 Vulnerability Scanner Overview CVE-2023-2...
“Hilariously insecure”: Andrew Tate’s The Real World breached, 800,000 users affected
Andrew Tate's online education platform The Real World—formerly known as Hustlers University—has been hacked and user data has been stolen. Hacktivists flooded the primary chatroom with emojis as proof that they had breached the site. After this they shared approximately 794,000 usernames of,...
Astra Linux – Vulnerability in cloud-init
Sensitive data may be exposed in logs of cloud-init before version 23.1.2. Attackers could use this information to obtain hashed passwords and potentially escalate their privileges...
CVE-2022-43937
Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a...