OPENSUSE-SU-2024:12729-1 terraform-provider-helm-2.9.0-1.1 on GA media

These are all security issues fixed in the terraform-provider-helm-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

How Healthcare Providers Should Think About Balancing Innovation Efforts with Cybersecurity Goals

...

Access Control Bypass

oauthenticator is vulnerable to Access Control Bypass. The vulnerability is due to the allowall setting taking precedence over identityprovider, allowing attackers to log in without restriction based on the intended institutional identity provider configuration...

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...

OAuthenticator Security Vulnerability

OAuthenticator is an OAuth token library for the JupyerHub login handler. A security vulnerability exists in OAuthenticator version 16.3.0 and earlier, which stems from the fact that the allowall configuration item took precedence over the identityprovider configuration item starting in JupyterHu...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: boring-registry, policy-controller, spire-server, up, wal-g, flux-source-controller, tekton-chains, timestamp-authority, harbor-registry, druid, grafana-agent-operator, terragrunt, tkn, nuclei, rclone, k8sgpt, opentelemetry-collector, cortex, fluent-bit-plugin-loki,...

Microsoft OLE DB Provider for SQL Server Security Vulnerability

Microsoft OLE DB Provider for SQL Server is an API from Microsoft Corporation that allows access to data from a variety of sources in a unified way. A security vulnerability exists in Microsoft OLE DB Provider for SQL Server. An attacker could exploit the vulnerability to remotely execute code. T...

ZendOpenID potential security issue in login mechanism

Using the Consumer component of ZendOpenId or ZendOpenId in ZF1, it is possible to login using an arbitrary OpenID account without knowing any secret information by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity MyOpenID, Google, etc,...

GHSA-3X57-M5P4-RGH4 ZendOpenID potential security issue in login mechanism

Using the Consumer component of ZendOpenId or ZendOpenId in ZF1, it is possible to login using an arbitrary OpenID account without knowing any secret information by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity MyOpenID, Google, etc,...

GHSA-9V78-H226-2RMQ Zendframework potential security issue in login mechanism

Using the Consumer component of ZendOpenId or ZendOpenId in ZF1, it is possible to login using an arbitrary OpenID account without knowing any secret information by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity MyOpenID, Google, etc,...

Zendframework potential security issue in login mechanism

Using the Consumer component of ZendOpenId or ZendOpenId in ZF1, it is possible to login using an arbitrary OpenID account without knowing any secret information by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity MyOpenID, Google, etc,...

PT-2024-35711 · Unknown · Lunary-Ai/Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint "/auth/saml/tto/download-idp-xml". The vulnerability...

Security Bulletin: A vulnerability in Microsoft .NET Core affects IBM Robotic Process Automation and may result in a bypass of security restrictions (CVE-2024-0056)

Summary A vulnerability in Microsoft .NET Core affects IBM Robotic Process Automation resulting in a bypass of security restrictions. Microsoft .NET Core is used by IBM Robotic Process Automation as part of it's development platform. This bulletin identifies the security fixes to apply to address...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, logstash-exporter, xcaddy, extism, haproxy-ingress, src, cue-fips, flannel-cni-plugin, sbomqs, cosign-fips, glab, cilium, terraform-provider-aws, opa-fips, http-echo, atlantis-fips, doppler-kubernetes-operator, vault-k8s-fips, tigera-operator,...

SUSE CVE-2023-45683

github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...

EAP: OIDC app attempting to access the second tenant, the user should be prompted to log

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...

EAP: OIDC app attempting to access the second tenant, the user should be prompted to log

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...

EAP: OIDC app attempting to access the second tenant, the user should be prompted to log

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...

IBM Security Verify Access Input Validation Error Vulnerability (CNVD-2024-26083)

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as the Web, mobile, IoT and cloud using risk-based access, single sign-on, integrated access management controls...

Insufficiently Protected Credentials

SimpleSAMLphp is vulnerable to Insufficiently Protected Credentials. The vulnerability is due to credentials being insecurely saved to the user's session state when the ECP profile is disabled but supported in the Identity Provider's metadata, which could result in an attacker with administrator...