PYSEC-2023-53

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

PYSEC-2023-53

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

CVE-2023-22738 Improper Preservation of Permissions in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

CVE-2023-22738 Improper Preservation of Permissions in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

vantage6 安全漏洞

vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in versions prior to vantage6 3.8.0 that stems from the system assigning existing users to different organizations, which could lead ...

GHSA-VVJV-97J8-94XH vantage6 vulnerable to Improper Preservation of Permissions

Impact Assigning existing users to a different organization is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed ...

Information disclosure

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

CVE-2023-1065

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

CVE-2023-1065

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

Decrypting Cyber Risk Quantification

Discover the evolution of cyber risk quantification, criteria for an accurate risk score, and its benefits across the organization...

Snyk kubernetes-monitor 授权问题漏洞

Snyk kubernetes-monitor is Snyk's tool for finding and fixing vulnerabilities in Kubernetes workloads using Snyk. Snyk kubernetes-monitor suffers from a security vulnerability that stems from the possibility of causing unrelated data to be published to the Snyk organization, which in turn may...

USN-5890-1 openvswitch vulnerabilities

Qian Chen discovered that Open vSwitch incorrectly handled certain Organization Specific TLVs. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code...

Deceptive Discord Campaign Targets Government Entities with PureCrypter Malware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Government entities in the Asia-Pacific and North American regions have been targeted by a threat actor using the PureCrypter malware downloader. This particular malware has been used to distribute vario...

PureCrypter Malware Targets Government Entities in Asia-Pacific and North America

Government entities in Asia-Pacific and North America are being targeted by an unknown threat actor with an off-the-shelf malware downloader known as PureCrypter to deliver an array of information stealers and ransomware. "The PureCrypter campaign uses the domain of a compromised non-profit...

New Attack Group Clasiopa Targets Materials Research Organization in Asia with Custom Malware

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary A new attack group called Clasiopa has been observed targeting materials research organizations in Asia using a distinct toolset that includes a custom malware called Backdoor.Atharvan. It is unclear wher...

CVE-2020-4339

CVE-2020-4339 is a stored cross-site scripting (XSS) vulnerability reported in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.3.0. It arises from insufficient input validation and missing output encoding, allowing a malicious user-supplied value written to the database/file to be d...

CVE-2019-4664

CVE-2019-4664 affects IBM Spectrum Scale (V5.0.0.0–V5.0.4.0). A local attacker could exploit a specially crafted request to execute arbitrary commands on the system. IBM provides a fix in V5.0.4.1 via Fix Central; no workarounds are listed. Affected product details and remediation are documented ...

CVE-2019-4756

This CVE-2019-4756 entry corresponds to a reflected cross-site scripting vulnerability in IBM InfoSphere Information Server and IBM InfoSphere QualityStage. Affected products and versions: IBM InfoSphere QualityStage (11.3, 11.5, 11.7) and IBM InfoSphere Information Server on Cloud (11.5, 11.7). ...

Design/Logic Flaw

Cerebrate 1.12 does not properly consider organisationid during creation of API keys...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...