rabbitmq -- Security issues in management plugin

The RabbitMQ project reports: Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI: When a user unqueued a message from the management UI, message details header names, arguments, etc. were displayed unescaped. An attacker could...

TORQUE Resource Manager: Multiple vulnerabilities

Background TORQUE is a resource manager and queuing system based on OpenPBS. Description Multiple vulnerabilities have been discovered in TORQUE Resource Manager. Please review the CVE identifiers referenced below for details. Impact A context-dependent attacker may be able to gain escalated...

[SECURITY] Fedora 20 Update: ctdb-2.5.4-2.fc20

CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aw are and use CTDB instead...

Important: Red Hat Security Advisory: mariadb-galera security update

Updated mariadb-galera packages that fix multiple security issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

CentOS 6 : pacemaker (CESA-2013:1635)

Updated pacemaker packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which...

Web Auditing Framework: GoLismero

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans. Features: Real platform independence. Tested on Windows, Linux, BSD and OS X. No native library dependencies. All of the framework has bee...

CVE-2014-3593

Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration...

CVE-2014-3593

Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration...

luci: privilege escalation through cluster with specially crafted configuration

It was discovered that luci used eval on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci...

PT-2014-5409 · Google +2 · Luci +2

Name of the Vulnerable Software and Affected Versions: luci version 0.26.0 Description: The issue allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration. Recommendations: For luci version 0.26.0, update to a version that fix...

Information disclosure

Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the 1 homebase, 2 cluster, 3 storage, 4 portalskins/custom, or 5 logs Luci extension...

No VM names for Hyper-V in SCOM

Challenge The Hyper-V topology is discovered correctly, however, the Display Names of Virtual Machines are listed as their VM IDs. Example: Additionally, error events 3603 are logged in the OperationsManager event log on the Hyper-V server: VMDiscovery.js : 'vmid' is null or not an object error...

Hyper-V Changed Block Tracking Troubleshooting

Challenge Backup and/or Replication jobs report that changed block tracking is not working properly. Article Applicability This article is only relevant when Veeam Backup & Replication is used with the following Hyper-V versions. In these older versions of Hyper-V there was no native CBT function...

Fedora 21 : nodejs-0.10.32-1.fc21 / v8-3.14.5.10-14.fc21 (2014-11132)

This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...

Fedora 19 : nodejs-0.10.32-1.fc19 / v8-3.14.5.10-14.fc19 (2014-10975)

This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...

PT-2014-3142 · Red Hat · Red Hat Conga +2

Name of the Vulnerable Software and Affected Versions: Red Hat Conga version 0.12.2 Description: The issue allows remote attackers to obtain sensitive information via a crafted request to specific Luci extensions, including homebase, cluster, storage, portal skins/custom, or logs. Recommendations...

PT-2014-5371 · Red Hat · Red Hat Conga +1

Name of the Vulnerable Software and Affected Versions: Red Hat Conga version 0.12.2 Description: The issue allows remote authenticated users to bypass intended access restrictions. This is achieved via a crafted URL in the /luci/homebase and /luci/cluster menu components. Recommendations: For Red...

[oCERT-2014-006] Ganeti insecure archive permission

2014-006 Ganeti insecure archive permission Description: Ganeti, an open source virtualisation manager, suffers from an insecure file permission vulnerability that leads to sensitive information disclosure. The Ganeti upgrade command 'gnt-cluster upgrade' creates an archive of the current...

RHEL 6 : MRG Messaging (RHSA-2012:1279)

Updated Messaging component packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.2 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common...

RHEL 5 : Red Hat Enterprise MRG Messaging 2.1 (RHSA-2012:0529)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0529 advisory. Red Hat Enterprise MRG Messaging, Realtime, and Grid is a next-generation IT infrastructure for enterprise computing. MRG offers increased performanc...