CVE-2024-28110 Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...

CVE-2024-28110

The CVE-2024-28110 issue affects the Go SDK for CloudEvents. Before version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper can cause credentials to be leaked by modifying http.DefaultClient’s Transport, leading to credentials bein...

CVE-2024-28110 Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...

GHSA-5PF6-2QWX-PXM2 Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Impact What kind of vulnerability is it? Who is impacted? Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. The relevant code is here also inline, emphasis added: if p.Client == n...

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Impact What kind of vulnerability is it? Who is impacted? Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. The relevant code is here also inline, emphasis added: if p.Client == n...

BIT-PARSE-2023-32689 Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server vi...

BIT-DOTNET-SDK-2021-24112 .NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability...

BIT-DOTNET-SDK-2021-26423 .NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability...

BIT-DOTNET-SDK-2021-26701 .NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability...

BIT-DOTNET-SDK-2021-31957 ASP.NET Core Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability...

BIT-DOTNET-SDK-2021-41355 .NET Core and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability...

BIT-DOTNET-SDK-2022-29145 .NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability...

BIT-DOTNET-SDK-2022-34716 .NET Spoofing Vulnerability

.NET Spoofing Vulnerability...

BIT-DOTNET-SDK-2022-38013 .NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability...

BIT-DOTNET-SDK-2022-41032 NuGet Client Elevation of Privilege Vulnerability

NuGet Client Elevation of Privilege Vulnerability...

BIT-DOTNET-SDK-2023-21538 .NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability...

BIT-DOTNET-SDK-2023-33135 .NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability...

BIT-DOTNET-SDK-2023-35390 .NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability...

BIT-DOTNET-SDK-2023-35391 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

BIT-HELM-2022-23525 Helm vulnerable to Denial of service via NULL Pointer Dereference

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the repopackage. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart...