ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEA… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  2. Amazon Web Services · EC2 · us-west-2 Changed list5 linked entries across history · in Other vendors Follow evidence and connection reasons
  3. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default opti… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  4. serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controllin… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  5. Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  6. The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry land… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  7. Identity and access | Identity and sign-in (beta): 7 API change passages Graph announcement revised · 7 passages4 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  8. Reports | Identity and access reports (beta): 4 API change passages Graph announcement revised · 4 passages4 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  9. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to … Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  10. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the p… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  11. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() … Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  12. ### Summary Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  13. body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a C… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  14. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jos… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  15. undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empt… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  16. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  17. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certi… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  18. Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  19. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  20. source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous e… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  21. Device and app management | Cloud PC (beta): 5 API change passages Graph announcement revised · 5 passages3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  22. Identity and access | Governance (v1.0): 4 API change passages Graph announcement revised · 4 passages3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  23. Mail (v1.0): 3 API change passages Graph announcement revised · 3 passages3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  24. Backup and recovery | Microsoft 365 backup and storage (v1.0): 4 API change passages Graph announcement revised · 4 passages3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  25. Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap +… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  26. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  27. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  28. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes … Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  29. Anthropic (Claude): Elevated errors on claude.ai, the Claude API, and Claude Code Service incident2 linked entries across history · in Other vendors Follow evidence and connection reasons
  30. Identity and access | Directory management (v1.0): 2 API change passages Graph announcement revised · 2 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 19:32 UTC · 274 of 275 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.