ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Amazon Web Services · GLOBALACCELERATOR Changed list3 linked entries across history · in Other vendors Follow evidence and connection reasons
  2. GitHub · packages Changed list3 linked entries across history · in Other vendors Follow evidence and connection reasons
  3. Microsoft Purview compliance portal: Data Loss Prevention – Restrict access action support for sematic models and lakehouses in Fabric Roadmap entry3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  4. PowerBI.NorwayWest Azure service tag changed2 linked entries across history · in Azure Follow evidence and connection reasons
  5. PowerBI.SoutheastAsia3 Azure service tag changed2 linked entries across history · in Azure Follow evidence and connection reasons
  6. PowerBI.TaiwanNorthwest Azure service tag changed2 linked entries across history · in Azure Follow evidence and connection reasons
  7. Storage.EastUS Azure service tag changed2 linked entries across history · in Azure Follow evidence and connection reasons
  8. Storage.WestUS3 Azure service tag changed2 linked entries across history · in Azure Follow evidence and connection reasons
  9. FlowiseDB vulnerable to SQL Injection by authenticated users Advisory content revised: Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated uns…2 linked entries across history · in Security Follow evidence and connection reasons
  10. Flowise allows arbitrary file write to RCE Advisory content revised: Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage…2 linked entries across history · in Security Follow evidence and connection reasons
  11. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  12. ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  13. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, … Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  14. undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed arra… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  15. VM2 Sandbox Breakout Through __lookupGetter__ Advisory content revised: vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host s…2 linked entries across history · in Security Follow evidence and connection reasons
  16. VM2 Has Sandbox Breakout Through Inspect Function Advisory content revised: vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arb…2 linked entries across history · in Security Follow evidence and connection reasons
  17. VM2 Has a Sandbox Escape Issue via SuppressedError Advisory content revised: vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.2 linked entries across history · in Security Follow evidence and connection reasons
  18. vm2's Transformer Fast-Path Bypass Exposes Internal State Variable Advisory content revised: vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandb…2 linked entries across history · in Security Follow evidence and connection reasons
  19. Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes … Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  20. ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds Advisory content revised: ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB f…2 linked entries across history · in Security Follow evidence and connection reasons
  21. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorizati… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  22. vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle dete… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  23. vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, a… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  24. vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  25. vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigge… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  26. vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, P… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  27. vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` Advisory content revised: vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internal…2 linked entries across history · in Security Follow evidence and connection reasons
  28. braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.j… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  29. GitHub: Incident with Webhooks Service incident2 linked entries across history · in Admin tools Follow evidence and connection reasons
  30. Amazon Web Services · AMAZON · eu-central-2 Changed list2 linked entries across history · in Other vendors Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 20:36 UTC · 274 of 275 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.