CVE-2024-34158 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, crossplane-provider-aws-memorydb, authservice, crossplane-provider-aws-sqs, fulcio, kube-logging-logging-operator, protoc-gen-go-grpc, neuvector, trivy-fips, crossplane-provider-aws-eks, cert-exporter-fips, mailpit, goreleaser, terraform,...

[SECURITY] Fedora 40 Update: onnx-1.14.1-3.fc40

onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...

Improper Access Control

directus is vulnerable to Improper Access Control. The vulnerability is due to improper handling of in and nin operators, which allows an attacker to query expressions with empty arrays, which are evaluated as valid, resulting in unauthorized access...

GHSA-HXGM-GHMV-XJJM Directus incorrectly handles `_in` filter

Summary Directus =9.23.0, .role matches any of ". Which should fail. This instead passes in Directus =v9.23.0 PoC "role": "in": $CURRENTUSER.somefield field validation would pass if $CURRENTUSER.somefield is null. Real scenario: Using https://github.com/u12206050/directus-extension-role-chooser...

Directus incorrectly handles `_in` filter

Summary Directus =9.23.0, .role matches any of ". Which should fail. This instead passes in Directus =v9.23.0 PoC "role": "in": $CURRENTUSER.somefield field validation would pass if $CURRENTUSER.somefield is null. Real scenario: Using https://github.com/u12206050/directus-extension-role-chooser...

Directus Security Vulnerabilities

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus versions 9.23.0 through 10.5.3 that stems from incorrect handling of the in, nin operators...

The vulnerability of the software for managing modules and services within Kubernetes Submariner Operators, related to errors in privilege management, allows a perpetrator to execute any container on a node.

The vulnerability of the software for installing, configuring, and managing Submariner in the Kubernetes Submariner Operator is related to errors in privilege management. Exploiting this vulnerability could allow a malicious actor to execute arbitrary containers on nodes remotely...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, authservice, fulcio, kube-logging-logging-operator, protoc-gen-go-grpc, neuvector, trivy-fips, cert-exporter-fips, goreleaser, terraform, kustomize-fips, metacontroller, nri-mssql, memcached-exporter, influx, stakater-reloader, nats-server,...

Google to Block Entrust Certificates in Chrome Starting November 2024

Google has announced that it's going to start blocking websites that use certificates from Entrust starting around November 1, 2024, in its Chrome browser, citing compliance failures and the certificate authority's inability to address security issues in a timely manner. "Over the past several...

Malicious code in data-platform-airflow-operators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5026 Malicious code in data-platform-airflow-operators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 273. Vulnerability Details CVEID:CVE-2023-6516 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an out-of-memory condition. By using specific...

CVE-2024-35225 Jupyter Server Proxy has a reflected XSS issue in host parameter

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting XSS issue. The /proxy endpoint accepts a host path segmen...

CVE-2024-35225

Jupyter Server Proxy (jupyter-server-proxy) has a reflected XSS in the host parameter of the /proxy endpoint. Affected versions: 3.x prior to 3.2.4 and 4.x prior to 4.2.0. The issue occurs when an invalid host value is echoed back, enabling a phishing link to execute arbitrary JavaScript in a use...

Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 271. Vulnerability Details CVEID:CVE-2024-1023 DESCRIPTION: Eclipse Vert.x is vulnerable to a denial of service, caused by a memory leak due to the use of Netty...

[SECURITY] Fedora 39 Update: onnx-1.14.0-9.fc39

onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...

[SECURITY] Fedora 40 Update: onnx-1.14.1-2.fc40

onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...

Fedora: Security Advisory (FEDORA-2024-abe1e34fdb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-270e3b5e9b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 267 Vulnerability Details CVEID:CVE-2024-20919 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause hi...