9090 matches found
Cross site scripting
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...
Cross site scripting
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...
CVE-2019-13415
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...
CVE-2019-13415
CVE-2019-13415 affects floragunn Search Guard (pre-24.3) where Cross Cluster Search (CCS) enabled allows authenticated users to read data they are not authorized to see. Root cause is an authorization issue in versions before 24.3; impact is unauthorized data exposure when CCS is used. Connected ...
CVE-2019-13416
Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...
CVE-2019-13416
CVE-2019-13416 affects floragunn Search Guard (Search Guard) prior to version 24.3. When Cross Cluster Search (CCS) is enabled, authenticated users can be authorized on the local cluster regardless of their roles on remote clusters, effectively bypassing remote-role checks. Affected component: Se...
August 13, 2019—KB4512489 (Security-only update)
None None...
August 13, 2019—KB4512507 (OS Build 15063.1988)
None None...
SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2019:2049-1)
This update for ceph fixes the following issues : Security issues fixed : CVE-2019-3821: civetweb: fix file descriptor leak bsc1125080 CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth bsc1121567 Non-security issues fixed: install grafana dashboards world readable...
kubectl path traversal vulnerability (CNVD-2019-26372)
kubectl is a command line program for running commands against a Kubernetes cluster. A path traversal vulnerability exists in kubectl. The vulnerability stems from a failure of a networked system or product to properly filter for special elements in a resource or file path. An attacker could use...
fence-agents: mis-handling of non-ASCII characters in guest comment fields
A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fencerhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to...
Moderate: Red Hat Security Advisory: fence-agents security, bug fix, and enhancement update
An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
Unauthorised Access
github.com/kubernetes/kubernetes is vulnerable to unauthorised access to the resources. API server allows a user with access privilege to the custom resources in one namespace to create, view update or delete the cluster-scoped resources...
July 9, 2019—KB4507458 (OS Build 10240.18275)
None None...
SUSE-SU-2019:2049-1 Security update for ceph
This update for ceph fixes the following issues: Security issues fixed: - CVE-2019-3821: civetweb: fix file descriptor leak bsc1125080 - CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth bsc1121567 Non-security issues fixed: - install grafana dashboards world...
API server allows access to custom resources via wrong scope
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L The API server mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the...
Cross site request forgery (csrf)
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perfo...
PT-2019-11606 · Red Hat · Openshift Container Platform
Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 3.11 and later Description: A flaw was found in the cluster console component where the CSRF tokens remain static during a user's session. An attacker able to observe the value of this token could re-use ...
