Kubernetes Dashboard < 1.10.1 Authentication Bypass Vulnerability

Kubernetes Dashboard is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Moderate: Red Hat Security Advisory: grafana security and bug fix update

The updated grafana package is now available for Red Hat Ceph Storage 3.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

Authentication flaw

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

Fedora 29 : community-mysql (2018-c82fc3e109)

MySQL 8.0.13 Release notes : https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-13.html CVEs fixed : CVE-2018-3276 CVE-2018-3200 CVE-2018-3137 CVE-2018-3284 CVE-2018-3195 CVE-2018-3173 CVE-2018-3212 CVE-2018-3279 CVE-2018-3162 CVE-2018-3247 CVE-2018-3156 CVE-2018-3161 CVE-2018-3278...

Fedora 28 : mysql-mmm (2018-ca5321b5ff)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

The vulnerability of the Kubernetes cluster management software lies in the lack of measures to neutralize special elements used in teams, allowing a hacker to execute arbitrary operating system commands.

The vulnerability of the Kubernetes cluster management software relates to the lack of measures taken to neutralize special elements used in operating systems’ commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands...

The vulnerability of the message processing mechanism implemented through the Cluster Management Protocol allows a attacker to cause a service failure in Cisco IOS and Cisco IOS XE operating systems.

The vulnerability of the message processing mechanism based on the Cluster Management Protocol CMP in Cisco IOS and Cisco IOS XE operating systems exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger service failures using...

Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML...

GHSA-3V44-382Q-55F4 Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML...

GHSA-43FP-VWWG-QGV6 Apache NiFi Improper Input Validation vulnerability

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

Apache NiFi Improper Input Validation vulnerability

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

Denial Of Service (DoS)

nifi-web-api is vulnerable to denial of service attacks. The vulnerability exists because there is a flaw in OkHttpReplicationClient.java which leads to missing content-Length check for DELETE requests and non-zero Content-Length header values when a client request to a cluster node was replicate...

Denial of service

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

CVE-2018-17194

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

CVE-2018-17194

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and...

Rancher < 1.6.25 / 2.0.9 / 2.1.3 Kubernetes Proxy Request Handling

The version of a Docker container of Rancher is prior to 1.6.25, 2.0.9, or 2.1.3 and, thus, is affected by a proxy request handling flaw contained in Kubernetes. A remote, unauthenticated attacker may be able to leverage API calls to escalate privileges via proxy request handling vulnerability...

CVE-2018-1279

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...