875766 matches found
MINI-9W9W-GFP9-JF3F
Bulletin has no description...
MINI-62R9-35M2-3R8P
Bulletin has no description...
MINI-RRQR-6G9J-R9FP
Bulletin has no description...
MINI-PM4X-5449-7V75
Bulletin has no description...
MINI-52C8-6799-C3WR
Bulletin has no description...
MINI-XXW5-H5R2-5RM8
Bulletin has no description...
MINI-VFFV-R52G-79JQ
Bulletin has no description...
MINI-P9FQ-345W-6HXC
Bulletin has no description...
MINI-FWC3-C24F-3VHG
Bulletin has no description...
MINI-QJ83-GHGV-6G5P
Bulletin has no description...
MINI-J4F3-QCHH-6CHH
Bulletin has no description...
GHSA-VRMH-5MMX-HJWX Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data
Private services EnableShowInService: false are enumerable via per-server endpoints, leaking name and timing data CWE: CWE-285 Improper Authorization via CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-863 Incorrect Authorization — inconsistent gating across data-reader...
GHSA-8QHJ-4F8C-J8QG Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
Summary The dashboard exposes the cron manual-trigger action as an authenticated GET /api/v1/cron/:id/manual endpoint. Dashboard JWTs are sent in the nz-jwt cookie and configured with SameSite=Lax, which browsers include on top-level cross-site GET navigations. Because this state-changing GET...
GHSA-MQQ6-462X-JXMM Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation Affected Component - github.com/dhax/go-base — Go REST API boilerplate go-chi/jwtauth/v5, Viper, PostgreSQL/Bun - 1,685 stars on GitHub Vulnerability Locations | File | Line | Role | |------|------|------| | dev.env | 10 |...
GHSA-5G86-85RP-F9HX Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
Summary Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but...
GHSA-CJ8G-PRCM-MFG5 @hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
Affected: @hulumi/baseline 1.4.0 — Fixed in: 1.4.0 — Severity: Medium — CWE-693 Protection Mechanism Failure Summary AccountFoundation can either create AWS detective services GuardDuty for threat detection, Security Hub for compliance dashboards or reuse pre-existing ones via opt-in flags. The...
GHSA-32G3-35G9-WC9G @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Affected: @hulumi/drift 1.4.0 — Fixed in: 1.4.0 — Severity: Medium — CWE-755 Improper Handling of Exceptional Conditions Summary @hulumi/drift runs four adapters that each ask a different question about whether a resource has drifted Pulumi-state diff, provider-version change, CloudTrail event,...
GHSA-2MXR-P26X-MJ73 @hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
Affected: @hulumi/baseline 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-1059 Insufficient Technical Documentation / Behavioral Inconsistency Summary The S3 bucket that AccountFoundation creates to receive CloudTrail and AWS Config audit logs is meant to be tamper-resistant — if someone with...
GHSA-9VC9-4JV3-RF86 @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-284 Improper Access Control Summary HULUMI-H1 forbids raw aws:s3:Bucket outside of Hulumi's SecureBucket component, with one exemption: a raw bucket that's a child of a SecureBucket is allowed because the component is...
GHSA-RHGJ-6G2C-FRMM @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...
GHSA-G759-4PXW-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-697 Incorrect Comparison Summary AWS IAM trust policies can list more than one federated identity provider — for example, a role that accepts BOTH GitHub Actions OIDC and Google's OIDC. The GOIDC1 and GOIDC2 policy rules ar...
MINI-59FR-W6RM-38G7
Bulletin has no description...
MINI-963X-5536-XMG8
Bulletin has no description...
MINI-C8PG-WRVP-QCCW
Bulletin has no description...
MINI-X4F9-RQRC-2WXG
Bulletin has no description...
MINI-2QGC-89PG-6J9P
Bulletin has no description...
MINI-H777-J92C-3W8R
Bulletin has no description...
MINI-2C3V-8HMV-C339
Bulletin has no description...
MINI-942H-5R63-9RGM
Bulletin has no description...
MINI-W3XG-7WCQ-VPXR
Bulletin has no description...
MINI-9799-CV2F-QQ3V
Bulletin has no description...
MINI-5J65-7FCP-5VC7
Bulletin has no description...
MINI-2QR9-R9RM-8X2R
Bulletin has no description...
MINI-3H29-5325-FF37
Bulletin has no description...
MINI-JMJP-G249-G2F9
Bulletin has no description...
MINI-R4M9-RR8M-MFC7
Bulletin has no description...
MINI-8XRP-PXRQ-83JJ
Bulletin has no description...
MINI-VRG9-JRR3-73H5
Bulletin has no description...
MINI-8G2P-77F2-8777
Bulletin has no description...
MINI-V57M-64C6-PHH2
Bulletin has no description...
MINI-V6HR-775H-6MH6
Bulletin has no description...
MINI-6C5V-78PX-PQ52
Bulletin has no description...
MINI-94WW-766G-M7J7
Bulletin has no description...
MINI-5CC3-XR69-GR3W
Bulletin has no description...
MINI-PXRC-Q344-GHVF
Bulletin has no description...
MINI-M56J-CG47-FMRV
Bulletin has no description...
MINI-QCRJ-4FGF-87JG
Bulletin has no description...
MINI-QRR7-FM24-57Q7
Bulletin has no description...
MINI-M7GG-R6WH-W5VX
Bulletin has no description...
MINI-W85C-6Q68-R6R9
Bulletin has no description...