31419 matches found
GHSA-WH78-7948-358J Cilium leaks sensitive information in cilium-bugtool
Impact The output of cilium-bugtool can contain sensitive data when the tool is run with the --envoy-dump flag set against Cilium deployments with the Envoy proxy enabled. Users of the following features are affected: - TLS inspection - Ingress with TLS termination - Gateway API with TLS...
Microsoft’s June 2024 Patch Tuesday Addresses 49 Vulnerabilities
...
CVE-2024-37164 CVAT SSRF via custom cloud storage endpoints
Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a CVAT...
CVE-2024-34064 affecting package python-jinja2 for versions less than 3.0.3-4
CVE-2024-34064 affecting package python-jinja2 for versions less than 3.0.3-4. A patched version of the package is available...
CVE-2024-26147 affecting package cert-manager for versions less than 1.11.2-10
CVE-2024-26147 affecting package cert-manager for versions less than 1.11.2-10. A patched version of the package is available...
CVE-2023-52447 affecting package kernel for versions less than 5.15.158.1-1
CVE-2023-52447 affecting package kernel for versions less than 5.15.158.1-1. A patched version of the package is available...
CVE-2023-52827 affecting package kernel for versions less than 5.15.158.2-1
CVE-2023-52827 affecting package kernel for versions less than 5.15.158.2-1. A patched version of the package is available...
CVE-2024-35176 affecting package ruby for versions less than 3.1.4-6
CVE-2024-35176 affecting package ruby for versions less than 3.1.4-6. A patched version of the package is available...
CVE-2023-45288 affecting package moby-containerd for versions less than 1.6.26-5
CVE-2023-45288 affecting package moby-containerd for versions less than 1.6.26-5. A patched version of the package is available...
CVE-2024-37297 WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be...
CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...
CVE-2024-37295 Aimeos Core remote code execution in web server context
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...
PT-2024-24048 · Cybozu · Cybozu Garoon
Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 5.0.0 through 5.15.2 Description: A cross-site scripting issue allows a remote authenticated attacker with administrative privileges to inject an arbitrary script into the web browser of a user logging into the product...
PT-2024-4747
Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version Description The issue is related to a logic error in the code, which could lead to local escalation of privilege with no additional execution privileges needed. User interaction is required for...
CVE-2024-35241
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are...
CVE-2024-35242
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are availab...
CVE-2024-35241
Summary: CVE-2024-35241 affects the PHP package manager Composer. On the 2.x branch, versions before 2.2.24 (2.2 LTS) and 2.7.7 (mainline) are vulnerable. The vulnerability allows code execution when using the status , reinstall , or remove commands with packages installed from source via git tha...
CVE-2024-35241
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are...
CVE-2024-35241
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are...