PT-2021-17177 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: The issue arises from the fact that tokens remain active even after the associated user account has been disabled. This is due to a problem in the util/session/sessionmanager.go file...

CVE-2021-26921: Insufficient Session Expiration

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

IBM MQ 7.5 / 8.0 / 9.0 < 9.0.0.11 LTS / 9.1 < 9.1.0.7 LTS / 9.2 < 9.2.0.1 LTS / 9.2 < 9.2.1 CD (6408626)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this...

Design/Logic Flaw

IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 191752...

CVE-2020-4869

IBM MQ Appliance 9.2 CD and 9.2 LTS are affected by CVE-2020-4869, a denial-of-service via buffer overflow triggered by a crafted SNMP query, causing the appliance to reload. IBM remediation for 9.2 LTS is fixpack 9.2.0.1; for 9.2 CD, interim fix IT34178 (iFix) is available. Affected products and...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

Code injection

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

CVE-2020-26294

Vela compiler before version 0.6.1 allows exposure of server configuration via Sprig's env function in templates. The vulnerability affects the Vela server/component and enables an attacker to retrieve configuration information, exposing sensitive data. The issue has been fixed in version 0.6.1; ...

Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC)

Exploit Title: Easy CD & DVD Cover Creator 4.13 - Denial of Service PoC Date: 22.12.2020 Software Link: http://www.tucows.com/download/windows/files/ezcdsetup.exe Exploit Author: Achilles Tested Version: 4.13 Tested on: Windows 7 x64 Sp1 1.- Run python code :Creator.py 2.- Open EVIL.txt and copy...

CVE-2020-26294: Improper Neutralization of Special Elements used in an OS Command

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

Easy CD & DVD Cover Creator 4.13 - Denial of Service Exploit

Exploit Title: Easy CD & DVD Cover Creator 4.13 - Denial of Service PoC Software Link: http://www.tucows.com/download/windows/files/ezcdsetup.exe Exploit Author: Achilles Tested Version: 4.13 Tested on: Windows 7 x64 Sp1 1.- Run python code :Creator.py 2.- Open EVIL.txt and copy content to...

Announcing the General Availability of Container Security in the VMware Carbon Black Cloud

Today, we are excited to announce the first release of Container Security capabilities in the Carbon Black Cloud. Building on our Cloud Workload Protection solution announced at VMworld, our new Container Security offering supports VMware’s Intrinsic Security vision to protect data and applicatio...

CVE-2020-4870

CVE-2020-4870 affects IBM MQ 9.2 CD and 9.2 LTS (and related IBM MQ versions per linked bulletin) via an error in the queue manager/channel processing that can be exploited to cause a denial of service when handling connecting applications. The root cause is an issue in the channel/connection pro...

CVE-2020-4757

CVE-2020-4757 affects IBM FileNet Content Manager and IBM Content Navigator 3.0.CD with a stored cross-site scripting vulnerability in the Web UI. The root cause is an XSS flaw in the Content Navigator/Content Manager web interface that could allow an attacker to embed arbitrary JavaScript, poten...

Security Bulletin: IBM MQ is affected by a vulnerability in json-c (CVE-2020-12762)

Summary An applicable vulnerability was found in the json-c library that is bundled with MQ server and native client installations. Vulnerability Details CVEID: CVE-2020-12762 DESCRIPTION: json-c could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow...

Achieve Operational Excellence in Your Cloud Workload

Explore the Operational Excellence pillar of the AWS and Azure Well-Architected Framework and examine best practices and design principles for cloud-based security operations, including CI/CD and risk management...

SQL Injection Vulnerability in Bo Yun CD-ROM System of Hangzhou Maida Electronics Co.

Hangzhou Maida Electronics Co., Ltd. provides professional library systems, including search, storage, access and other functions, customers involved in the domestic major universities and provincial and municipal libraries. A SQL injection vulnerability exists in Bo Yun CD-ROM system of Hangzhou...

Free MP3 CD Ripper 2.8 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Free MP3 CD Ripper 2.6 %q This module exploits a buffer overflow in Free MP3 CD Ripper versions 2.6 and 2.8. By constructing a specially crafted...

Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Free MP3 CD Ripper 2.6 %q This module exploits a buffer overflow in Free MP3 CD Ripper versions 2.6 and 2.8. By constructing a specially crafted...