6138 matches found
CVE-2020-25654
CVE-2020-25654 affects Pacemaker: an ACL bypass flaw where a local attacker in the haclient group can use IPC to communicate with various daemons and perform tasks disallowed by ACLs. Documented impact includes potential bypass of ACL restrictions via IPC instead of configuration. Multiple adviso...
CVE-2020-29006: Missing Authorization
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php...
PT-2020-17082
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.135 Description The issue is related to a lack of an ACL check in MISP, specifically in the app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php files. Recommendations For versions prior to...
CVE-2020-25654: Improper Access Control
An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration...
CVE-2020-28053
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...
UBUNTU-CVE-2020-28053
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...
CVE-2020-28053
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...
CVE-2020-28053
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...
CVE-2020-28053
Removed by vendor...
PT-2020-16913
Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.2.0 through 1.8.5 Description The issue allows operators with operator:read ACL permissions to read the Connect CA private key configuration. This is a problem of privilege escalation...
CVE-2020-28053: Incorrect Authorization
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...
Debian DSA-4791-1 : pacemaker - security update
Ken Gaillot discovered a vulnerability in the Pacemaker cluster resource manager: If ACLs were configured for users in the 'haclient'group, the ACL restrictions could be bypassed via unrestricted IPC communication, resulting in cluster-wide arbitrary code execution with root privileges. If the...
Authorization Bypass
pacemaker is vulnerable to authorization bypass. The vulnerability exists through an ACL bypass flaw, where users can use IPC communication with the various daemons directly to bypass ACL restrictions...
[SECURITY] [DSA 4791-1] pacemaker security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4791-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 13, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DLA 2447-1] pacemaker security update
Debian LTS Advisory DLA-2447-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 11, 2020 https://wiki.debian.org/LTS Package : pacemaker Version : 1.1.16-1+deb9u1 CVE ID : CVE-2020-25654 Debian Bug : 973254 An ACL bypass flaw was found in pacemaker, a...
Debian: Security Advisory (DLA-2447-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-OU-2020:3291-1 Optional update for python-redis and redis
This optional update for python-redis and redis provides the following fixes python-redis: - Update to version to 3.4.1 jscECO-2417 Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Pacemaker vulnerability (USN-4623-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4623-1 advisory. Ken Gaillot discovered that Pacemaker incorrectly handled IPC communications permissions. A local attacker could possibly use this issue t...
