Argo CD GitOps Engine does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...

Security Bulletin: Vulnerability in urllib3 affects watsonx.data

Summary urllib3 could allow a remote authenticated attacker to obtain sensitive information. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-37891 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to strip...

Impact of Azure AD Graph Deprecation on Veeam Plug-In for Microsoft Azure

Challenge Data protection of Azure services may fail using any version of Veeam Plug-In for Microsoft Azure below v6 build number 6.0.0.234. Cause Starting February 1, 2025, Microsoft has retired Azure AD Graph. As a result, any application relying on Azure AD Graph will be unable to make request...

FreeBSD-SA-25:04.ktrace

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:04.ktrace Security Advisory The FreeBSD Project Topic: Uninitialized kernel memory disclosure via ktrace2 Category: core Module: ktrace Announced: 2025-01-29...

Security Bulletin: Vulnerability in Apache ZooKeeper ( CVE-2024-51504) affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential security bypass vulnerability CVE-2024-51504 has been identified related to Apache ZooKeeper that affects IBM watsonx Assistant for IBM Cloud Pak for Data. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...

Security Bulletin: Vulnerability in Apache Tomcat ( CVE-2024-34750) may affect IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential denial of service vulnerability CVE-2024-34750 has been identified related to Apache Tomcat that may affect IBM watsonx Assistant for IBM Cloud Pak for Data. vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...

Security Bulletin: Vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager (CVE-2024-38808,CVE-2024-38809).

Summary Vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager CVE-2024-38808,CVE-2024-38809. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2024-38809 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service,...

Potential DoS when using ContextLines integration

Impact The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing events. The stream was not explicitly closed after use. This could lead to excessive amounts of file handles open ...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the account linking logic. An attacker can anticipate and use the email address of a user to register a public frontend user account before the user's first OIDC login, leading to...

CVE-2024-23953 Apache Hive: Timing Attack Against Signature in LLAP util

Use of Arrays.equals in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0,...

CVE-2024-50083 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50083 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

Insertion of Sensitive Information Into Sent Data

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data. Go Vulnerability Report: The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a reque...

Google Chrome < 132.0.6834.160 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 132.0.6834.160. It is, therefore, affected by a vulnerability as referenced in the 202501stable-channel-update-for-desktop28 advisory. - Use after free in DevTools. CVE-2025-0762 Note that Nessus has not tested for this...

PT-2025-4506 · Unknown · Simple Locator

Name of the Vulnerable Software and Affected Versions: Simple Locator versions n/a through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS in NotFound Simple Locator...

PT-2025-2136 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized access due to a missing capability check on the youzify offe...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in express-4.19.2.tgz

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of express-4.19.2.tgz Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: expressjs express is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker coul...

Important: tomcat

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

PT-2025-5392 · Icegram · Icegram

Name of the Vulnerable Software and Affected Versions: Icegram versions through 3.1.31 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions through...

PT-2025-5396 · Unknown · Rstheme Ultimate Coming Soon & Maintenance

Name of the Vulnerable Software and Affected Versions: RSTheme Ultimate Coming Soon & Maintenance versions 1.0.0 through 1.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.0.0 through 1.0.9,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of http-proxy-middleware Vulnerability Details CVEID:CVE-2024-21536 DESCRIPTION: http-proxy-middleware is vulnerable to a denial of service, caused by an UnhandledPromiseRejection error thrown by micromatch. By...