GO-2022-0440 Woodpecker allows cross-site scripting (XSS) via build logs in github.com/woodpecker-ci/woodpecker

Woodpecker allows cross-site scripting XSS via build logs in github.com/woodpecker-ci/woodpecker...

GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd

Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd...

GO-2023-1793 secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver

secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver...

WordPress plugin AI Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-37638 · WordPress +1 · Ai Engine Wordpress Plugin +1

Name of the Vulnerable Software and Affected Versions: AI Engine versions 2.4.3 AI Engine WordPress plugin versions prior to 2.5.1 Description: The issue is related to remote-code-execution RCE via Log Poisoning. The AI Engine WordPress plugin fails to validate the file extension of logs path,...

Ingress-nginx Annotation Validation Bypass

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the...

The Hidden Security Gaps in Your SaaS Apps: Are You Doing Due Diligence?

SaaS applications have become indispensable for organizations aiming to enhance productivity and streamline operations. However, the convenience and efficiency these applications offer come with inherent security risks, often leaving hidden gaps that can be exploited. Conducting thorough due...

CVE-2024-40620

CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the...

CVE-2024-40620

CVE-2024-40620 affects Rockwell Automation Pavilion8, specifically version 5.20 (and later). The root cause is missing encryption of sensitive data exchanged between the Console and the Dashboard, which can be observed in proxy-server logs, potentially compromising confidentiality. Rockwell Autom...

CVE-2024-41719

When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager CM, F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-39809

CVE-2024-39809 affects BIG-IP Next Central Manager. The central manager user session refresh token does not expire after logout, enabling a continued session if cookies are obtained. This is a control-plane issue with high impact (no data-plane exposure). F5's advisory lists vulnerable lineage as...

PT-2024-29535 · F5 · F5 Big-Ip Next

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP Next affected versions not specified Description: When generating a QKView of a BIG-IP Next instance from the BIG-IP Next Central Manager, F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note that software...

F5 BIG-IP Next Central Manager 安全漏洞

F5 BIG-IP Next Central Manager is a centralized console from F5 USA. A security vulnerability exists in F5 BIG-IP Next Central Manager that stems from the fact that F5 iHealth credentials will be recorded in the BIG-IP Central Manager logs...

The vulnerability of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps allows a perpetrator to disclose protected information.

The vulnerability of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information stored in...

CVE-2024-38193

creationtimestamp| type| source ---|---|--- 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review 2024-08-13 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-08-13 21:18:33+00:00| seen| https://t.me/cvedetector/3065...

Illuminating the Shadows: Managing the Risks of Shadow AI in Modern Enterprises

Understanding the challenge of Shadow AI Shadow AI – a dramatic term for a new problem. With the rise of widely available consumer level AI services with easy-to-use chat interfaces, anyone from the summer intern to the CEO can easily use these shiny and new AI products. However, anyone who’s eve...

Network restriction bypass via race condition during namespace termination

CVSS Rating: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Low 3.1 A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace...

The vulnerability of the AssumeRoleWithWebIdentity request of the Security Token Service (AWS STS) – a single API for interacting with object storage services and local files in Apache Arrow Rust Object Store – allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the AssumeRoleWithWebIdentity request of the Security Token Service AWS STS – a single API for interacting with object storage services and local files – is related to insufficient protection of registration data. Exploiting this vulnerability allows an attacker to bypass...

Gitlab -- Vulnerabilities

Gitlab reports: Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access Cross project access of Security policy bot Advanced search ReDOS in highlight for code results Denial of Service via banzai pipeline Denial of service using adoc files ReDoS in RefMatcher when matching...

CVE-2024-23458

While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows 4.2.0.190...