corosync: Denial of service

Background The Corosync Cluster Engine is a Group Communication System with additional features for implementing high availability within applications. Description It was discovered that corosync allowed an unauthenticated user to cause a Denial of Service by application crash. Impact A remote...

Beware password-spraying fancy bears

The NSA, FBI, and CISA, in cooperation with the UKs National Cyber Security Centre NCSC, have issued a report that describes in detail why, and how, they think that a Russian military unit is behind large-scale brute-force attacks on the cloud-IT resources of government and private sector compani...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony

Summary This interim fix provides instructions on upgrading Apache Tomcat from v6.0.43 to v8.5.41 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerabilities CVE-2019-0199 and CVE-2019-10072 in Apache Tomcat. Vulnerability Details CVE-ID: CVE-2019-0199 DESCRIPTION: Apache...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony

Summary This interim fix provides instructions on upgrading Apache Tomcat from v6.0.43 to v8.5.37 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerability CVE-2018-11784 in Apache Tomcat. Vulnerability Details CVE-ID: CVE-2018-11784 Description: Apache Tomcat could allow...

July 6, 2021—KB5004958 (Security-only update) Out-of-band

None None...

NSA-CISA-NCSC-FBI Joint Cybersecurity Advisory on Russian GRU Brute Force Campaign

The National Security Agency NSA, Cybersecurity and Infrastructure Security Agency CISA, Federal Bureau of Investigation FBI, and the UK’s National Cyber Security Centre NCSC have released Joint Cybersecurity Advisory CSA: Russian GRU Conducting Global Brute Force Campaign to Compromise Enterpris...

Unauthorized access vulnerability in the interlib library cluster management system (CNVD-2021-49125)

interlib library cluster management system is a new generation of literature and information management software, using B/S mode, open multi-layer structure system, based on the Internet to realize the combination of traditional business management and massive digital resource management. The...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by security vulnerabilities (CVE-2015-4974, CVE-2015-4981)

Summary Security vulnerabilities have been identified in the current levels of IBM Spectrum Scale V4.1.1, IBM GPFS V4.1 and V3.5: - could allow a local non privileged attacker to execute commands with root privileges CVE-2015-4974 - could allow a local non privileged attacker to read system...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a security vulnerability (CVE-2020-14336)

Summary Red Hat OpenShift Container Platform is vulnerable to a denial of service, caused by a flaw in the Restricted Security Context Constraints SCC. By sending specially crafted network packets, an attacker could exploit this vulnerability to cause a denial of service CVE-2020-14336...

GHSA-9QQ2-XHMC-H9QR Access Control Bypass

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the...

Access Control Bypass

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.4 security and bug fix update

Red Hat Advanced Cluster Management for Kubernetes 2.2.4 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

SAP Netweaver JAVA 7.50 Missing Authorization

Onapsis Security Advisory 2021-0013: CVE-2020-26829 - Missing Authentication Check In SAP NetWeaver AS JAVA P2P Cluster communication Impact on Business A malicious unauthenticated user could abuse the lack of authentication check on SAP Java P2P cluster communication, in order to connect to the...

The vulnerability of the Veritas InfoScale backup and data storage application, the Veritas Access data storage system, and the Veritas Cluster Server (VCS) application for clustering open systems lies in the absence of measures to clean incoming data. This allows a malicious actor to execute arbitrary commands.

The vulnerability of the Veritas InfoScale backup and data storage application, the Veritas Access data storage system, and the Veritas Cluster Server VCS for clustering open systems is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote...

CVE-2021-20182

A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability (CVE-2020-8554)

Summary IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster CVE-2020-8554 Vulnerability Details CVEID: CVE-2020-8554 Description: Kubernetes could allow a remote authenticate...

Logic flaw vulnerability in interlib library cluster management system

interlib library cluster management system is a new generation of literature and information management software, using B/S mode, open multi-layer structure system, based on the Internet to realize the combination of traditional business management and massive digital resource management. There i...

PT-2021-6669 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to a buffer overflow in memory, allowing a remot...

Virtuozzo Hybrid Infrastructure 4.6 (4.6.0-208)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' operability. The improvements cover compute services, object storage, monitoring, security, localization, and the user interface. Additionally, this release delivers stability...

GHSA-MV55-23XP-3WP8 Access control flaw in Kiali

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0. This flaw allows an attacker with a basic level of access to the cluster to deploy a kiali operand to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access ...