UBUNTU-CVE-2024-36476

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ibsge list' is accessible Move the declaration of the 'ibsge list' variable outside the 'alwaysinvalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ibsge list' was...

Description of the security update for SharePoint Server Subscription Edition: January 14, 2025 (KB5002676)

None None...

OESA-2025-1035 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in dmardevscopeinit foreachpcidev is implemented by pcigetdevice. The comment of pcigetdevice says that it will increase...

PT-2025-37957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was discovered in the Linux kernel related to the initialization of fields within the sctp v6 from sk function in the SCTP Stream Control Transmission Protocol implementation...

undertow: information leakage via HTTP/2 request header reuse

REJECTED CVE A vulnerability has been identified in the Undertow package where the readHpackString method may incorrectly reuse an HTTP request header value from a previous stream for a new request on the same HTTP/2 connection due to improper handling of the stringBuilder field. While this...

automation-gateway: aap-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5

A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...

Malicious code in req-ip-scope (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cac8b2dfbc3066e94727e843a2abe5a2af44476170248c207bf5026a8892d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11123 Malicious code in req-ip-scope (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cac8b2dfbc3066e94727e843a2abe5a2af44476170248c207bf5026a8892d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GitLab Enterprise Edition和GitLab Community Edition 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition and GitLab Community...

CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...

PT-2024-9295 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.9.8 through 17.4.5 GitLab CE/EE versions 17.5 through 17.5.3 GitLab CE/EE versions 17.6 through 17.6.1 Description: The issue is related to the incorrect handling of token scopes in GitLab CE/EE, which could allow...

CVE-2024-52287

authentik (open-source identity provider) has a vulnerability in the handling of client_credentials and device_code OAuth grants: an attacker could obtain a token with scopes that haven’t been configured. Root cause described as insufficient validation of OAuth scopes. Affected versions include 2...

PT-2024-17021 · Red Hat · Ansible +1

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform AAP affected versions not specified Ansible nan affected versions not specified Description: A vulnerability was found in the Ansible Automation Platform AAP and Ansible nan, allowing attackers to escalate privileg...

DEBIAN-CVE-2023-6110

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials...

CVE-2023-6110

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials...

CVE-2023-6110 Openstack: deleting a non existing access rule deletes another existing access rule in it's scope

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials...

CVE-2021-1491

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

Wrap Up the Year with the Biggest Scope and Rewards Yet: Join the Wordfence Bug Bounty Program End of Year Holiday Extravaganza!

The holidays are here, and so is your chance to earn big while helping secure the WordPress ecosystem! For all submissions to our Bug Bounty Program from November 12, 2024, to December 9, 2024 , we’re rolling out our End of Year Holiday Extravaganza promotion to give back to our security...

GHSA-6P55-QR3J-MPGQ AgentScope uses `eval`

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

MAL-2024-10251 Malicious code in req-scope (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05048fd5770283947973e00b424f5a1810a67067ed3451a3bb5f9f5a5ce5d703 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...