.NET Framework, .NET Core, And PowerShell Core Security Vulnerabilities

Spin applications with specific configuration vulnerable to potential network sandbox escape

Impact Some specifically configured Spin applications that use self requests without a specified URL authority can be induced to make requests to arbitrary hosts via the Host HTTP header. If an application's manifest contains a component with configuration such as toml allowed_outbound_hosts =...

LiteSpeed Cache Plugin XSS Vulnerability Affects 1.8M WordPress Sites

By Deeba Ahmed Is your WordPress site using LiteSpeed Cache? A recent surge in malicious JavaScript injections targets vulnerable versions. Learn how to identify the signs of infection and prevent future attacks. Patch, scan, and secure your WordPress site today! This is a post from HackRead.com...

Citrix Hypervisor Security Update for CVE-2024-31497

Description of Problem Versions of XenCenter for Citrix Hypervisor 8.2 CU1 LTSR included a 3rd-party component, PuTTY, that is used to enable SSH connections from XenCenter to guest VMs when the “Open SSH Console” button is selected. The inclusion of PuTTY with XenCenter for Citrix Hypervisor 8.2.....

Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution

Cisco Talos' Vulnerability Research team recently disclosed three zero-day vulnerabilities that are still unpatched as of Wednesday, May 8. Two vulnerabilities in this group -- one in the Tinyroxy HTTP proxy daemon and another in the stb_vorbis.c file library -- could lead to arbitrary code...

obrassomusic.nl Cross Site Scripting vulnerability OBB-3926897

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: traefik, cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, oauth2-proxy, crossplane-provider-azure, sigstore-scaffolding-fips, caddy, temporal-server-fips, kubernetes-csi-driver-hostpath, istio-pilot-agent, policy-controller-fips,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, dex, nodetaint, kubevela, nginx-stable, dgraph, traefik, frp, cluster-autoscaler-fips, external-secrets, newrelic-infrastructure-agent, tomcat, pulumi-language-dotnet, pulumi-language-yaml, cilium-envoy, gitlab-pages, spark-operator,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, prometheus-postgres-exporter-fips, dex, nodetaint, prometheus-mysqld-exporter, kubevela, dgraph, frp, cluster-autoscaler-fips, trust-manager, external-secrets, containerd, newrelic-infrastructure-agent, kubernetes,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: go, dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, hey, falco, grpcurl, restic, kyverno, kube-state-metrics, seldon-core-operator, wireguard-go,...

GHSA-69CH-W2M2-3VJP vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, hey, vt-cli, grpcurl, kube-state-metrics, seldon-core-operator, gitleaks,...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: go, dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, hey, falco, grpcurl, restic, kyverno, kube-state-metrics, seldon-core-operator, wireguard-go,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, fulcio-fips, nri-discovery-kubernetes, dgraph, cluster-autoscaler-fips, configmap-reload, protoc-gen-go-grpc, gobuster, amass, newrelic-nri-kube-events, cilium-envoy, go-md2man, aws-flb-kinesis, go-bindata, slsa-verifier,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: traefik, cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, oauth2-proxy, crossplane-provider-azure, sigstore-scaffolding-fips, caddy, temporal-server-fips, kubernetes-csi-driver-hostpath, istio-pilot-agent, policy-controller-fips,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

GHSA-5F94-VHJQ-RPG8 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, fulcio-fips, nri-discovery-kubernetes, dgraph, cluster-autoscaler-fips, configmap-reload, protoc-gen-go-grpc, gobuster, amass, newrelic-nri-kube-events, cilium-envoy, go-md2man, aws-flb-kinesis, go-bindata, slsa-verifier,...

CVE-2022-27664 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, hey, grpcurl, kube-state-metrics, seldon-core-operator, wireguard-go,...

GHSA-R48Q-9G5R-8Q2H vulnerabilities

Vulnerabilities for packages: kube-state-metrics, seldon-core-operator,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-csi, cluster-autoscaler-fips, harbor, external-secrets, go-fips, filebeat-fips, vault-k8s, thanos-operator, harbor-scanner-trivy-fips, go-bindata, oauth2-proxy, crossplane-provider-azure, sigstore-scaffolding-fips, caddy, temporal-server-fips,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2023-39326 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, fulcio-fips, nri-discovery-kubernetes, dgraph, cluster-autoscaler-fips, configmap-reload, protoc-gen-go-grpc, gobuster, amass, newrelic-nri-kube-events, cilium-envoy, go-md2man, aws-flb-kinesis, go-bindata, slsa-verifier,...

GHSA-8C26-WMH5-6G9V vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, seldon-core-operator,...

CVE-2022-41721 vulnerabilities

Vulnerabilities for packages: kyverno, seldon-core-operator,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: velero-plugin-for-csi, cluster-autoscaler-fips, harbor, external-secrets, go-fips, filebeat-fips, vault-k8s, thanos-operator, harbor-scanner-trivy-fips, go-bindata, oauth2-proxy, crossplane-provider-azure, sigstore-scaffolding-fips, caddy, temporal-server-fips,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

GHSA-FXG5-WQ6X-VR4W vulnerabilities

Vulnerabilities for packages: kyverno, seldon-core-operator,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, prometheus-postgres-exporter-fips, dex, nodetaint, prometheus-mysqld-exporter, kubevela, dgraph, frp, cluster-autoscaler-fips, trust-manager, external-secrets, containerd, newrelic-infrastructure-agent, kubernetes,...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: prometheus-postgres-exporter-fips, dex, fulcio-fips, prometheus-mysqld-exporter, dgraph, certificate-transparency, terraform-fips, argo-workflows, frp, cluster-autoscaler-fips, nerdctl, traefik, external-secrets, temporal-ui-server-fips, containerd, kubernetes,...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: prometheus-postgres-exporter-fips, dex, fulcio-fips, prometheus-mysqld-exporter, dgraph, certificate-transparency, terraform-fips, argo-workflows, frp, cluster-autoscaler-fips, nerdctl, traefik, external-secrets, temporal-ui-server-fips, containerd, kubernetes,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: prometheus-postgres-exporter-fips, dex, nodetaint, prometheus-mysqld-exporter, kubevela, dgraph, frp, cluster-autoscaler-fips, trust-manager, external-secrets, containerd, newrelic-infrastructure-agent, pulumi-language-dotnet, pulumi-language-yaml,...

CVE-2022-32149 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, hey, vt-cli, grpcurl, kube-state-metrics, seldon-core-operator, gitleaks,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, dex, nodetaint, kubevela, nginx-stable, dgraph, traefik, frp, cluster-autoscaler-fips, external-secrets, newrelic-infrastructure-agent, tomcat, pulumi-language-dotnet, pulumi-language-yaml, cilium-envoy, gitlab-pages, spark-operator,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, fulcio-fips, nri-discovery-kubernetes, dgraph, cluster-autoscaler-fips, configmap-reload, protoc-gen-go-grpc, gobuster, amass, newrelic-nri-kube-events, cilium-envoy, go-md2man, aws-flb-kinesis, go-bindata, slsa-verifier,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: prometheus-postgres-exporter-fips, dex, nodetaint, prometheus-mysqld-exporter, kubevela, dgraph, frp, cluster-autoscaler-fips, trust-manager, external-secrets, containerd, newrelic-infrastructure-agent, pulumi-language-dotnet, pulumi-language-yaml,...

GHSA-69CG-P879-7622 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, hey, grpcurl, kube-state-metrics, seldon-core-operator, wireguard-go,...

CVE-2022-1996 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, seldon-core-operator,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, external-secrets, filebeat-fips, vault-k8s, thanos-operator, go-bindata, crossplane-provider-azure, caddy, temporal-server-fips, doppler-kubernetes-operator, cass-operator, ip-masq-agent, gomplate, nri-couchbase, flux-helm-controller-0.37,...

CVE-2022-27191 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, py3-seldon-core, k3d, dynamic-localpv-provisioner, seldon-core-operator,...

CVE-2022-44793 affecting package net-snmp 5.9-4

CVE-2022-44793 affecting package net-snmp 5.9-4. No patch is available...

CVE-2022-44792 affecting package net-snmp 5.9-4

CVE-2022-44792 affecting package net-snmp 5.9-4. No patch is available...

johncoostore.com Cross Site Scripting vulnerability OBB-3926896

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-4654

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/cloudInterface.php. The manipulation of the argument INSTI_CODE leads to sql injection. It is possible to initiate the attack remotely......

CVE-2024-34347

@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the....

CVE-2024-3951

PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious...

CVE-2024-4653

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /xds/outIndex.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The...