16961 matches found
Credentials Exposure
Zowe CLI is vulnerable to a credentials exposure. The vulnerability is due to insecure storage of credentials in the Zowe CLI's auto-init operation, allowing attackers to access and potentially misuse sensitive information stored in a plaintext file...
BIT-HYPERLEDGER-FABRIC-PEER-2022-31121 Improper Input Validation in fabric hyperledger
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error ...
BIT-HYPERLEDGER-FABRIC-TOOLS-2022-45196
Hyperledger Fabric 2.3 allows attackers to cause a denial of service orderer crash by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist...
BIT-WORDPRESS-MULTISITE-2024-35655
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Brave Brave Popup Builder allows Stored XSS.This issue affects Brave Popup Builder: from n/a through 0.6.9...
BELL-CVE-2024-41010
Bulletin has no description...
Intel Dynamic Tuning Technology (DTT) Software May 2024 Security Update
Intel has informed HP of a potential security vulnerability in some Intel® Dynamic Tuning Technology DTT software installer which might allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Intel has released updates to mitigate the...
PYSEC-2024-63
In Roundup before 2.4.0, classhelpers generic.help.html allow XSS...
CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...
BELL-CVE-2024-41008
Bulletin has no description...
BELL-CVE-2023-52886
Bulletin has no description...
Skupper uses a static cookie secret for the openshift oauth-proxy
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a...
CVE-2024-38446
NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...
CVE-2024-38447
NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...
CVE-2024-6655
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
BELL-CVE-2024-40994
Bulletin has no description...
BELL-CVE-2024-40992
Bulletin has no description...
BELL-CVE-2024-40983
Bulletin has no description...
BELL-CVE-2024-40987
Bulletin has no description...