HashiCorp Nomad Access Control Error Vulnerability

HashiCorp Nomad is a distributed, data center-aware cluster and application scheduler from HashiCorp, USA. The program supports the deployment of microservices, batch, containerized and non-containerized applications. An access control error vulnerability exists in HashiCorp Nomad versions 0.9.0...

UBUNTU-CVE-2019-12618

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

Design/Logic Flaw

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

CVE-2019-12618

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

CVE-2019-12618

Removed by vendor...

CVE-2019-12618

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

CVE-2019-12618

CVE-2019-12618 affects HashiCorp Nomad 0.9.0–0.9.1 with Incorrect Access Control via the exec driver. Root cause described as an access control error leading to privilege escalation via the exec driver. A fix is available in Nomad 0.9.2 (and later); update recommended. No exploitation details are...

CVE-2019-12618

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

CVE-2019-12618

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

PT-2019-12895 · Hashicorp · Hashicorp Nomad

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad versions 0.9.0 through 0.9.1 Description: The issue is related to Incorrect Access Control via the exec driver. This affects the access control mechanism in HashiCorp Nomad, potentially allowing unauthorized access...

CVE-2019-12618: Improper Privilege Management

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver...

PT-2019-1006

Name of the Vulnerable Software and Affected Versions: container-tools affected versions not specified Description: The issue concerns the container-tools module, which includes tools such as podman, buildah, skopeo, and runc. There are problems with podman exec not distinguishing between stopped...

PT-2019-11498

Name of the Vulnerable Software and Affected Versions: PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b Description: The issue concerns improper neutralization of special elements used in a command, which can lead to command injection. This allows for the manipulation of gpg-keys or...

EulerOS 2.0 SP2 : libvirt (EulerOS-SA-2019-1724)

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API CVE-2019-10161 - libvirt: arbitrary command execution via...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

PT-2019-13082

Name of the Vulnerable Software and Affected Versions Centreon versions 18.x through 18.10.5 Centreon versions 19.x through 19.04.2 Centreon web versions prior to 2.8.29 Description The issue allows an attacker to execute arbitrary system commands. This is achieved by using the value init script ...

DEBIAN-CVE-2019-12929

The QMP guestexec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU'...

PT-2019-13029 · Qemu +2 · Qemu +2

Name of the Vulnerable Software and Affected Versions: QEMU versions 4.0.0 and earlier Description: The QMP guest exec command in QEMU is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP comma...

RHEL 7 : libvirt (RHSA-2019:1579)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1579 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems...