linuxfoundation Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

yocto8 vulnerabilities
edge_virtualization_engine3 vulnerabilities
zowe_api_mediation_layer3 vulnerabilities
argo-cd2 vulnerabilities
onnx2 vulnerabilities
cortex1 vulnerability
fluid1 vulnerability
opendaylight1 vulnerability
runc1 vulnerability

linuxfoundation vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-9802MEDIUM	Conformance validation endpoint discloses detail about service to unauthenticated users The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running. CWE-312Oct 10, 2024	CVSS5.3v3.1	EPSS0.205%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-9798MEDIUM	Health endpoint offers list of onboarded services to unauthenticated users The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers. CWE-312Oct 10, 2024	CVSS5.3v3.1	EPSS0.231%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6834CRITICAL	Imperative Local Command Injection allows Activity Masking A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials. CWE-250Jul 17, 2024	CVSS9.0v3.1	EPSS0.263%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX