Target Vela Operating System Command Injection Vulnerability

Target Vela is a pipeline automation CI/CD framework based on Go language, Linux container technology from Target Canada. Vela suffers from a security vulnerability that allows the disclosure of server configuration. An attacker could exploit the vulnerability to retrieve configuration informatio...

EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1008)

According to the version of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting...

EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1027)

According to the version of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting...

Dotcms dotCMS SQL注入漏洞

dotcms is a powerful Content Management System CMS developed in Java. A SQL injection vulnerability exists in dotCMS versions prior to 20.10.1. An attacker can exploit this vulnerability to conduct SQL injection attacks via the /api/v1/containers orderby parameter...

Netflix Spinnaker Code Issue Vulnerability

Netflix Spinnaker is a continuous delivery platform from the American company Netflix. The platform serves as a cloud platform deployment tool that supports Google, Microsoft, Pivotal, and other cloud platforms, providing out-of-the-box cluster management and deployment capabilities. Netflix...

SUSE SLES15 Security Update : buildah (SUSE-SU-2020:3423-1)

This update for buildah fixes the following issues : buildah was updated to v1.17.0 bsc1165184 : Handle cases where other tools mount/unmount containers overlay.MountReadOnly: support RO overlay mounts overlay: use fusermount for rootless umounts overlay: fix umount Switch default log level of...

Docker Images notary security vulnerability

Docker is an open source application container engine from the American company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrading of applications...

Docker Security Vulnerabilities

Docker is an open source application container engine from the American company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrading of applications...

VMware Enables Zero Trust Through Intrinsic Security

For decades, the central philosophy behind security has been to treat the network like a castle: Build the walls higher, make the moat deeper and wider. But the onset of the primarily telework environment within the federal government has moved much of the activity outside the network perimeter, ...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

Input validation

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-27151

CVE-2020-27151 affects the Kata Containers runtime through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries provided via annotations without any validation, allowing a user with cluster access to have kata-runtime execute arbitrary binaries as root on worker nodes. The connected ...

Kata Containers Security Vulnerability

Kata Containers is an open source lightweight virtual machine builder from the Kata Containers community. A security vulnerability exists in Kata Containers version 1.11.3 and versions 2.x through 2.0-rc1, which stems from a runtime that will execute binaries using comments without any type of...

Privilege Escalation

containerd is vulnerable to privilege escalation. Access controls for the shim's API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network...

Oracle Linux 7 : docker-cli / docker-engine (ELSA-2020-5966)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5966 advisory. - Fix for CVE-2020-15257 - Fix for CVE-2020-15157 - Address CVE-2020-16845 - update to 19.03.11 for CVE-2020-13401 - apply...

Oracle Linux 7 : containerd (ELSA-2020-5964)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5964 advisory. - Addresses CVE-2020-15257 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not test...

DEBIAN-CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...