Code injection

Secret token configuration is never applied when using ECK =8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment...

Resetting a sub-account's guard manually from the Main Console can potentially lead to a permanent denial of service (DoS) for that sub-account.

Lines of code Vulnerability details Impact If the Main Console resets the guard, resets the fallback handler, or disables itself as a module of a sub-account, the executors will permanently cease executing any transactions on that sub-account. And also if the Main Console resets the fallback...

The vulnerability of the Windows operating system’s kernel, related to security configuration errors, allows attackers to circumvent existing security restrictions.

The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow attackers to bypass existing security restrictions...

CVE-2023-24855

Memory corruption in Modem while processing security related configuration before AS Security Exchange...

CVE-2023-24855 Use of Out-of-range Pointer Offset in Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange...

CVE-2023-24855 Use of Out-of-range Pointer Offset in Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange...

CVE-2023-24855

CVE-2023-24855 is a memory-corruption in Qualcomm’s modem when processing security-related configuration before the AS Security Exchange. Root cause described as an out-of-bounds pointer offset that can lead to remote code execution. Public sources (Qualcomm bulletin, Red Hat/PRION notes) describ...

PT-2023-5876 · Qualcomm · Qualcomm

Name of the Vulnerable Software and Affected Versions: Qualcomm affected versions not specified Description: The issue is related to memory corruption in the modem while processing security-related configuration before AS Security Exchange. This corruption is due to an out-of-bounds pointer offse...

The vulnerability of the IBM Robotic Process Automation software, related to security configuration errors, allows a perpetrator to alter the cluster configuration.

The vulnerability of the IBM Robotic Process Automation software lies in security configuration errors. Exploiting this vulnerability could allow an attacker to alter the cluster configuration...

The vulnerability of the IBM Robotic Process Automation software, related to security configuration errors, allows attackers to exploit their privileges.

The vulnerability of the IBM Robotic Process Automation software lies in security configuration errors. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the MSHTML platform in Windows operating systems allows attackers to circumvent existing security restrictions.

The vulnerability of the MSHTML platform in Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

The vulnerability of the Microsoft Office software package, related to security configuration errors, allows attackers to circumvent existing security restrictions.

The vulnerability of the Microsoft Office suite is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions remotely...

The vulnerability of Microsoft Defender operating systems for Windows, related to security configuration errors, allows a hacker to bypass existing security restrictions.

The vulnerability of Microsoft Defender’s operating system vulnerabilities is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass existing security restrictions using a specially created file...

Remote Code Execution

ethyca-fides is vulnerable to Arbitrary Code Execution. The vulnerability is due to certain API clients who have a special level of permission called "CONNECTORTEMPLATEREGISTER." In the Fides Admin interface one can upload a zip file with arbitrary python code and can execute it. Exploitation is...

GHSA-P6P2-QQ95-VQ5H Remote Code Execution in Custom Integration Upload

Impact The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox...

CVE-2023-41319

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

Default configuration

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...