412 matches found
CVE-2024-1713
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum...
CVE-2024-1713
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum...
CVE-2024-1713
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum...
CVE-2024-1713
Summary of CVE-2024-1713 (Plv8 Deferred Trigger Privilege Escalation) Affects plv8 version 3.2.1. If a user can create objects in a database, they can cause deferred triggers to execute as the Superuser during autovacuum. This is a privilege-escalation scenario with impact on confidentiality, int...
PT-2024-18244 · Plv8 · Plv8
Name of the Vulnerable Software and Affected Versions: plv8 version 3.2.1 Description: A user who can create objects in a database with plv8 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. Recommendations: For plv8 version 3.2.1, consider restricting...
Plv8 Code Issues Vulnerabilities
Plv8 is a shared library that provides the PostgreSQL procedural language supported by the V8 Javascript engine. A security vulnerability exists in Plv8 version 3.2.1, which originates from the ability of a user who creates objects in the database to execute delayed triggers as a superuser during...
BIT-PARSE-2022-41878 Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the...
PT-2024-22305 · Jenkins · Jenkins Subversion Partial Release Manager Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Subversion Partial Release Manager Plugin versions 1.0.1 and earlier Description: A missing permission check in the plugin allows attackers with Item/Read permission to trigger a build. Recommendations: For Jenkins Subversion Partial...
PT-2023-8381 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.7.0 through 2.7.3 Description: The issue is related to insufficient authentication of executed requests in Apache Airflow, allowing an attacker to trigger a DAG in a GET request without CSRF validation. This could...
Hacking the Human Mind: Exploiting Vulnerabilities in the 'First Line of Cyber Defense'
Humans are complex beings with consciousness, emotions, and the capacity to act based on thoughts. In the ever-evolving realm of cybersecurity, humans consistently remain primary targets for attackers. Over the years, these attackers have developed their expertise in exploiting various human...
[SECURITY] Fedora 39 Update: watchman-2021.05.10.00-24.fc39
Watchman exists to watch files and record when they actually change. It can a lso trigger actions such as rebuilding assets when matching files change...
Malicious code in python-alibabacloud-tea-openapi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...
CVE-2023-32284
An out-of-bounds write vulnerability exists in the tiffplanaradobe functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability...
Information disclosure
Parse Server is an open source backend server. In affected versions the Parse Cloud trigger beforeFind is not invoked in certain conditions of Parse.Query. This can pose a vulnerability for deployments where the beforeFind trigger is used as a security layer to modify the incoming query. The...
CVE-2023-41058
Parse Server fixed a vulnerability where the Cloud trigger beforeFind was not invoked under certain Parse.Query conditions. The issue could bypass the security layer provided by beforeFind. The fix refactored the internal query pipeline and added a patch to ensure beforeFind is invoked. The fix w...
Malicious code in aliyun-oss2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c33f6b28da216b43120a3b8a8537d0263dc1eb2b22979a4183b371ff57b9e0b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
Malicious code in python-aliyun-sdk-ecs (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx fcb822b0528f2cbde54bd2197ed8c774dda8cafc7c3e9ae5aff56465e7c6c72c Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
CVE-2023-33383
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload...
Important: Red Hat Bug Fix Advisory: Red Hat OpenShift Pipelines 1.10.5 release
Red Hat OpenShift Pipelines 1.10.5 General Availability release - A cloud-native Continuous Integration and Delivery solution on OpenShift. Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery CI/CD solution for building pipelines using Tekton. Tekton is a flexible,...