1507 matches found
dotnet: .NET Elevation of Privilege Vulnerability
An elevation of privilege vulnerability was found in .NET. This flaw allows an attacker to write a specially crafted file in the security context of the local system...
PT-2025-30796
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the handling of anonymous inodes and security contexts. A regression existed where the S PRIVATE flag was not cleared after allocating anonymo...
CVE-2024-41752 IBM Cognos Analytics HTML injection
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook
A flaw was found in the Linux kernel. A highly privileged user on a Network File System NFS client can bypass intended security restrictions and modify security labels on files located on an NFS filesystem. This issue occurs even when root squashing, a security feature designed to limit root user...
kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook
A flaw was found in the Linux kernel. A highly privileged user on a Network File System NFS client can bypass intended security restrictions and modify security labels on files located on an NFS filesystem. This issue occurs even when root squashing, a security feature designed to limit root user...
CVE-2024-52945
An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL...
cpython: python: Memory race condition in ssl.SSLContext certificate store methods
A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “certstorestats” and “getcacerts”. The race condition can be triggered if the methods are called at the same time that certificates are...
Xorg-x11-server: selinux context corruption
...
Improper Privilege Management
github.com/openshift/openshift-controller-manager is vulnerable to Improper Privilege Management. The vulnerability is due to misuse of elevated privileges during the build process, where the git-clone container is run with a privileged security context, allowing an attacker to provide a crafted...
CVE-2024-45496
CVE-2024-45496 is an OpenShift OpenShift Controller Manager issue describing elevated privileges in the build process. The root cause is the git-clone container running with a privileged security context during build initialization, allowing a crafted .gitconfig to execute commands during cloning...
CVE-2024-45496
A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An...
Security Bulletin: IBM Jazz Reporting Services is vulnerable to a to cross-site scripting (CVE-2020-4051)
Summary Cross-site scripting has been identified in dojo library shipped with IBM Jazz Reporting Services JRS. JRS has addressed the issues by releasing a fix Vulnerability Details CVEID:CVE-2020-4051 DESCRIPTION: Dijit is vulnerable to cross-site scripting, caused by improper validation of...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to cross-site scripting due to Jinja2 ( CVE-2024-34064 )
Summary Jinga2 is used by IBM Cloud Pak for Data as part of the installation operator. CVE-2024-34064. Vulnerability Details CVEID:CVE-2024-34064 DESCRIPTION: Jinja is vulnerable to cross-site scripting, caused by the acceptance of keys containing non-attribute characters by the xmlattr filter. A...
CVE-2024-39741
creationtimestamp| type| source ---|---|--- 2024-07-15 05:58:18+00:00| seen| https://t.me/cvedetector/835...
CVE-2023-35006
IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2023-35006
IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
Clone Job Fails Due to Security Context Constraints (SCC) Issue
Challenge Cloned-restore jobs time out and eventually fail because an application's security context provides permissions in the original application namespace. This results in the application's pod being in a non-running state. Example: Namespace = quay-enterprise SCC during deployment = anyuid...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability in...
GHSA-QG5R-95M4-MJGJ Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
During the internal penetration testing of our product based on Yii2, we discovered an XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. Conditions for vulnerability reproduction The framework is in debug mode YIIDEBUG set to true. The...