https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:41:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-244702 EUVD-2026-244702 https://cve.radiocsirt.org/vuln/euvd-2026-244702 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46740 <p>CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the &#34;accesKey&#34;, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.</p> <p>CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the &#34;accesKey&#34;, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-46740 https://cve.radiocsirt.org/vuln/ghsa-4248-p65p-hcrm <p><strong>Affected:</strong> Go: github.com/cubefs/cubefs</p> <p>CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges.</p> <p>When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the &#34;accesKey&#34;, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user.</p> <p>An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges.</p> <p>There is no evidence of this vulnerability being exploited in the wild. It was found during a security audit carried out by [Ada Logics](https://adalogics.com/) in collaboration with [OSTIF](https://ostif.org/) and the [CNCF](https://www.cncf.io/).</p> <p>The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.</p> <p><strong>Affected:</strong> Go: github.com/cubefs/cubefs</p> <p>CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges.</p> <p>When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the &#34;accesKey&#34;, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user.</p> <p>An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges.</p> <p>There is no evidence of this vulnerability being exploited in the wild. It was found during a security audit carried out by [Ada Logics](https://adalogics.com/) in collaboration with [OSTIF](https://ostif.org/) and the [CNCF](https://www.cncf.io/).</p> <p>The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.</p> https://cve.radiocsirt.org/vuln/ghsa-4248-p65p-hcrm https://cve.radiocsirt.org/vuln/gsd-2023-46740 gsd-2023-46740 https://cve.radiocsirt.org/vuln/gsd-2023-46740