Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: A previously undocumented Android spyware called 'EagleMsgSpy' has been discovered and is believed to be used by law enforcement agencies in China to monitor mobile devices. [...]
December 11th, 2024 (4 months ago)
|
|
|
Description: A critical flaw in the company's rate limit for failed sign-in attempts allowed unauthorized access to a user account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more.
December 11th, 2024 (4 months ago)
|
CVE-2024-55655 |
Description: Summary
Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present.
This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise.
Details
Sigstore uses signed time to support verification of signatures made against short-lived signing keys.
Impact
The impact and severity of this weakness is low, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify).
Separately, an attacker could upload a new entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.
References
https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7
https://nvd.nist.gov/v...
EPSS Score: 0.05%
December 11th, 2024 (4 months ago)
|
|
|
Description: Impact
Impersonation is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the linked documentation a specific level of privilege (usually assigned to cluster admins) is required for impersonation.
The vulnerability in kcp affects kcp installations in which users are granted the cluster-admin ClusterRole (or comparably high permission levels that grant impersonation access; the verb in question is impersonate) within their respective workspaces. As kcp builds around self-service confined within workspaces, most installations would likely grant such workspace access to their users. Such users can impersonate special global administrative groups, which circumvent parts of the authorizer chains, e.g. maximal permission policies.
Patches
The problem has been patched in #3206 and is available in kcp 0.26.1 and higher.
Workarounds
Not assigning the cluster-admin role (or any other role granting blanket impersonation permissions) to users.
A reverse proxy between users and kcp to check for the Impersonate-Group header and reject requests that impersonate global administrative groups.
References
See the pull request (#3206).
References
https://github.com/kcp-dev/kcp/security/advisories/GHSA-c7xh-gjv4-4jgv
https://github.com/kcp-dev/kcp/pull/3206
https://github.com/kcp-dev/kcp/commit/24ab5d4dc35ddff98a2e5fdc236e1681f03283ec
https://github.com/advisories/GHSA-c7xh-gjv4-4jgv
December 11th, 2024 (4 months ago)
|
|
|
Description: Summary
Siyuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables
Impact
Information leakage
References
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://github.com/advisories/GHSA-4pjc-pwgq-q9jp
December 11th, 2024 (4 months ago)
|
|
|
Description: Summary
Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
Impact
Arbitrary File Read
References
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://github.com/advisories/GHSA-25w9-wqfq-gwqx
December 11th, 2024 (4 months ago)
|
|
|
Description: Summary
The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS (via the file write).
Impact
Arbitrary file write
References
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://github.com/advisories/GHSA-fqj6-whhx-47p7
December 11th, 2024 (4 months ago)
|
|
|
Description: Summary
An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system.
Impact
Arbitrary file read on the host
References
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://github.com/advisories/GHSA-xx68-37v4-4596
December 11th, 2024 (4 months ago)
|
|
|
Description: Russian cyber-espionage group Turla, aka "Secret Blizzard," is utilizing other threat actors' infrastructure to target Ukrainian military devices connected via Starlink. [...]
December 11th, 2024 (4 months ago)
|
|
|
Description: Facebook, Instagram, Threads, and WhatsApp suffered a massive worldwide Wednesday afternoon, with services impacted in varying degrees based on user's region. [...]
December 11th, 2024 (4 months ago)
|