Security Bulletin: Information disclosure in persistent watchers handling

Summary Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher addWatch command to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check...

Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.16 security and bug fix update

The Migration Toolkit for Containers MTC 1.7.16 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Malicious code in stylishteks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40a8ed6d750df7841026d152bf8840677964a636c2377940003db377ae525481 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-31314

In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-31314

In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Malicious code in addcohort (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7c7c14de394a6a49ce28fc5eac784de2b16faab93f257a8f142b5b32564bfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/illum-quidem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd15ba0019e3a1a688c4a7f881d55ebba37d8b7e19fc1b2a8c4f55856c93798f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/officia-tempora-sequi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a0db1890c2143a131ce07eb08219825a3d054031562e71489dab5dcfeabfc20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/molestias-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4203d5d6cf9467afa779754419b8356ce12d342a64bf06773b36a3d04940e4a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/itaque-nesciunt-voluptatibus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d20c232adf35eee773aba9024dfa9d48b92b227809834242b2f0c851270689f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/quia-sapiente (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac1bcf9c797c7505ef34a65a8b7cd8bf67a4e7a4dff46e77a134869e4af3c93c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7150 Malicious code in @zitterorg/cupiditate-fugiat-culpa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 505aa19c407d211fbbff5a2b9e252641bc3dac0ed45bb8c4a67cc3baebbd2a60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/velit-autem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9338884be8e4522ff1bf86cec4a775020a3fd583cdcddb7a167a5cba79d258af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/iure-consequatur-nostrum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45fb454d23f187cd3ebe45f6cf2a05cf25bf0aa862d41a56159b3ffbfcf39774 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/incidunt-cum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a48ed2154d858356e5de2be6327986d6a3f0b2955dec808c9986bae75d0b3550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Citrix CDFControl Service How to Save Logs On A UNC Network Share

Sometimes it may be necessary to save trace data to a shared network folder, for example, crash/hang issues with non-persistent VDAs or due to local disk space constraints...

CVE-2024-39310 WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting XSS via the posttitle parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access...

CVE-2024-36992

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthoriz...

CVE-2024-36997 Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a...

CVE-2024-36997 Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a...