How to Add a Blueprint Target Using Execution Hooks From the Policy API

Purpose This article explains how to set resources other than namespaces as the hooks for blueprint subjects. By default, hooks sets the namespace as the target for the blueprint unless specified otherwise. Solution Veeam Kasten for Kubernetes supports kanister execution hooks through Policy API...

The vulnerability of GE HealthCare’s ultrasonic diagnostic systems lies in the incorrect assignment of permissions to critical resources. This allows unauthorized access by intruders, enabling them to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of GE HealthCare’s ultrasonic diagnostic systems lies in the incorrect assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information and enhance their privileges...

Siemens Teamcenter Visualization and JT2Go

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Azure Service Tags Vulnerability: Microsoft Warns of Potential Abuse by Hackers

Microsoft is warning about the potential abuse of Azure Service Tags by malicious actors to forge requests from a trusted service and get around firewall rules, thereby allowing them to gain unauthorized access to cloud resources. "This case does highlight an inherent risk in using service tags a...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

Security and Human Behavior (SHB) 2024

This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of...

GHSA-F3WF-Q4FJ-3GXF TYPO3 Denial of Service in Online Media Asset Handling

Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...

CVE-2024-37163 SkyScrape Secure API Requests

SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0...

CVE-2024-37163 SkyScrape Secure API Requests

SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0...

Fedora: Security Advisory for qt5-qtquickcontrols2 (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of service in langchain-community

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap...

CVE-2024-2965

A Denial-of-Service DoS vulnerability exists in the SitemapLoader class of the langchain-ai/langchain repository, affecting all versions. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the...

CVE-2023-45192

IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 268758...

CVE-2023-45192 IBM Engineering Requirements Management DOORS Next XML external entity injection

IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 268758...

CVE-2023-45192

IBM Engineering Requirements Management DOORS Next versions 7.0.2 and 7.0.3 are affected by an XML External Entity Injection (XXE) when processing XML data. A remote attacker could potentially expose sensitive information or exhaust memory resources due to the vulnerable XML processing. Remediati...

CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...

CVE-2024-5482

CVE-2024-5482 describes a Server-Side Request Forgery in the Parisneo/Lollms-WebUI - specifically the add_webpage/add webpage endpoint. The issue arises from insufficient URL validation, allowing attackers to supply arbitrary URLs (including localhost/127.0.0.1) and trigger unauthorized requests ...

CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...

Important: Red Hat Security Advisory: booth security update

An update for booth is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2024-36425 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest Description: A Server-Side Request Forgery SSRF vulnerability exists in the "add webpage" endpoint, allowing attackers to input arbitrary URLs, including those targeting internal resources such as localhos...