Malicious code in express-jwt-v6 (npm)

-= Per source details. Do not edit below this line.=- Source: ossf-package-analysis (fe7d6a9d5298553234316cd7fd21bd7ac74d55c02a1e156505dd54dc8944e648) The OpenSSF Package Analysis project identified & ...

Continue Reading
(RHSA-2024:4484) Important: OpenShift Container Platform 4.13.45 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the contain ...

Continue Reading
(RHSA-2024:4329) Important: OpenShift Container Platform 4.14.32 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the contain ...

Continue Reading
(RHSA-2024:4156) Important: OpenShift Container Platform 4.16.1 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the contain ...

Continue Reading
CVE-2024-39315

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the lo ...

Continue Reading
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Impact The Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed t ...

Continue Reading
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Impact The Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed t ...

Continue Reading
CVE-2024-5798

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audie ...

Continue Reading

Back to Main

Subscribe for the latest news: