CVE-2021-41117 Insecure random number generation

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

sshd in OpenSSH 6.2 through 8.x before 8.8 when certain non-default configurations are used allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process if the configuration specifies running the command as a different user.

...

kubernetes: Symlink exchange can allow host filesystem access

A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem...

kubernetes: Symlink exchange can allow host filesystem access

A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem...

kubernetes: Symlink exchange can allow host filesystem access

A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem...

UBUNTU-CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

CVE-2021-21993

The vCenter Server contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosur...

CVE-2021-21993

The vCenter Server contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosur...

CVE-2021-25741

A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem. Mitigation OpenShift Container Platform runs with SELinux in enforcing mode, whic...

CVE-2021-33698

SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files including script files without the proper file format validation...

DoD Cloud Computing Impact Level 6 – the unclassified edition

The final Impact Level IL referenced in the Department of Defense DoD Cloud Computing CC Security Requirements Guide SRG is IL6. IL6 allows Cloud Service Providers CSPs to store information up to SECRET or below. CSPs can utilize their own infrastructure or deploy their cloud service offering CSO...

F5 BIG-IP APM资源管理错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. The F5 BIG IP APM OCSP denial of service vulnerability can be exploited by attackers to cause a denial of service DoS on the...

CVE-2021-21600

Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentially exploit this vulnerability via the web and desktop user interfaces, leading to denial of service in the manageability path...

CVE-2013-6276

QNAP FVioCard 2312 and FVioGate 2308 have hardcoded entries in authorizedkeys files. NOTE: 1. All active models are not affected. The last affected model was EOL since 2010. 2. The legacy authorization mechanism is no longer adopted in all active models...

CVE-2013-6276

QNAP FVioCard 2312 and FVioGate 2308 have hardcoded entries in authorizedkeys files. NOTE: 1. All active models are not affected. The last affected model was EOL since 2010. 2. The legacy authorization mechanism is no longer adopted in all active models...

PT-2021-8376 · Qnap · Qnap F Viocard 2312 +1

Name of the Vulnerable Software and Affected Versions: QNAP F VioCard 2312 affected versions not specified QNAP F VioGate 2308 affected versions not specified Description: The issue concerns hardcoded entries in authorized keys files. It is noted that all active models are not affected, and the...

UBUNTU-CVE-2021-38173

Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using sshfilterbtrbk.sh in authorizedkeys...

CVE-2021-38173

Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using sshfilterbtrbk.sh in authorizedkeys...

btrbk 命令注入漏洞

btrbk is a software application. A backup tool for btrfs subvolumes that utilizes btrfs-specific features to create atomic snapshots and incrementally transfer them to your backup location. btrbk has a security vulnerability. Btrbk before 0.31.2 allows command execution due to error handling of S...

Atlassian Confluence Server 安全漏洞

Atlassian Confluence Server is the server version of a suite of collaboration software from Atlassian Australia with enterprise knowledge management capabilities and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server that allows remote attackers t...