ObserverIP Scan Tool 1.4.0.1 Denial Of Service

Exploit Title: ObserverIP Scan Tool 1.4.0.1 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link: https://p10.secure.hostingprod.com/@site.ambientweatherstore.com/ssl/iptools/IPTools64bit.exe Tested Version: 1.4.0....

Central Management Software 1.4.13 - Denial of Service (PoC)

Exploit Title: Central Management Software v1.4.13 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link:...

ObserverIP Scan Tool 1.4.0.1 - Denial of Service (PoC)

Exploit Title: ObserverIP Scan Tool 1.4.0.1 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link: https://p10.secure.hostingprod.com/@site.ambientweatherstore.com/ssl/iptools/IPTools64bit.exe Tested Version: 1.4.0....

cri-o: capabilities are not dropped when switching to a non-root user

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

Privilege Context Switching Error

github.com/kubernetes-incubator/cri-o is susceptible to privilege context switching error. The vulnerability exists in handling ambient capabilities. During container execution, containers running with elevated privileges may allow a user with lower privilege to perform abilities they should not...

Privilege escalation

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

Access Restriction Bypass

github.com/opencontainers/runc is vulnerable to attackers bypassing access restrictions. This is possible when ambient capabilities are enabled but misconfigured. It would allow malicious images to bypass user permissions and access other files within the file system and other mounted volumes. Th...

Stealing Browsing History Using Your Phone's Ambient Light Sensor

There has been a flurry of research into using the various sensors on your phone to steal data in surprising ways. Here's another: using the phone's ambient light sensor to detect what's on the screen. It's a proof of concept, but the paper's general conclusions are correct: There is a lesson her...

Arbitrary File Traversal Vulnerability in Ampcom Application Gateway

Ambient Application Gateway is an inter-network device developed by Beijing Ambient Technology Co., Ltd. to interconnect one network with another and provide specific applications. An arbitrary file traversal vulnerability exists in the ABT Application Gateway. An attacker can use user-controllab...

Oracle Linux 6 / 7 : docker-engine / docker-engine-selinux (ELSA-2017-3511)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3511 advisory. - Fix runC privilege escalation CVE-2016-9962 - Fix ambient capability usage in containers CVE-2016-8867 27610 Tenable has extracted the preceding descripti...

SUSE-SU-2016:3084-1 Security update for Docker and dependencies

This update for Docker and its dependencies fixes the following issues: - fix runc and containerd revisions bsc1009961 docker: - Updates version 1.11.2 to 1.12.3 bsc1004490, bsc996015, bsc995058 - Fix ambient capability usage in containers bsc1007249, CVE-2016-8867 - Change the internal mountpoin...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

CVE-2016-8867 affects Docker Engine 1.12.2, where ambient capabilities were enabled due to misconfigured capability policies. This allowed a malicious image to bypass container user permissions and access files in the container filesystem or mounted volumes. The issue is cited across multiple adv...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867: Undefined Security Weakness

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...