diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 1cc3940ee287..052688a320d7 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,66 @@ + + minio -- unintentional information disclosure + + + minio + 2024.05.27.19.17.46 + + + + +

Minio security advisory GHSA-95fr-cm4m-q5p9 reports:

+
+

when used with anonymous requests by sending a random + object name requests you can figure out if the object + exists or not on the server on a specific bucket and also + gain access to some amount of information. +

+
+ + + + CVE-2024-36107 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36107 + + + 2024-05-28 + 2024-06-05 + + + + + minio -- privilege escalation via permissions inheritance + + + minio + 2024.01.31.20.20.33 + + + + +

Minio security advisory GHSA-xx8w-mq23-29g4 ports:

+
+

+ When someone creates an access key, it inherits the + permissions of the parent key. Not only for s3:* actions, + but also admin:* actions. Which means unless somewhere + above in the access-key hierarchy, the admin rights are + denied, access keys will be able to simply override their + own s3 permissions to something more permissive. +

+
+ + + + CVE-2024-24747 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24747 + + + 2024-01-31 + 2024-06-05 + + + firefox -- Potential memory corruption and exploitable crash