Oracle Linux 8 : container-tools:ol8 (ELSA-2021-0531)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0531 advisory. buildah 1.16.7-4.0.1 - Handling redirect from the docker registry Orabug: 29874238 Nikita Gerasimov 1.16.7-4 - update to the latest content of...

podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API

An information disclosure flaw was found in containers/podman. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container leak into subsequent containers. This flaw allows an...

RHEL 8 : container-tools:rhel8 (RHSA-2021:0531)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0531 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: podman: environment...

openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2021-278)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Security issues fixed : - CVE-2020-15257: Fixed a privilege escalation in containerd bsc1178969. - CVE-2021-21284: potential privilege escalation when the root user in the remapped...

Damn-Vulnerable-GraphQL-Application - Damn Vulnerable GraphQL Application Is An Intentionally Vulnerable Implementation Of Facebook's GraphQL Technology, To Learn And Practice GraphQL Security

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. About DVGA Damn Vulnerable GraphQL is a deliberately weak and insecure implementation of GraphQL that provides a safe environment to attack a...

SUSE-SU-2021:0445-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Update Docker to 19.03.15-ce: - CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem bsc1181732 - CVE-2021-21285:...

OPENSUSE-SU-2021:0278-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2020-15257: Fixed a privilege escalation in containerd bsc1178969. - CVE-2021-21284: potential privilege escalation when the root user in the remapped namespac...

SUSE SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2021:0435-1)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Security issues fixed : CVE-2020-15257: Fixed a privilege escalation in containerd bsc1178969. CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace...

Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork (important)

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork Announcement ID: openSUSE-SU-2021:0278-1 Rating: important References: 1174075 1176708 1178801 1178969 1180243 1180401 1181730 1181732 Cross-References: CVE-2020-15257 CVE-2021-21284...

Vulners Linux Audit API for Host Vulnerability Detection: Manual Auditing, Python Scripting and Licensing

Hello everyone! This episode will be about Vulners Linux Audit API, which allows you to detect vulnerabilities on a Linux host knowing only the OS version and installed packages. I had a similar post about this 4 years ago, but some details have changed, so I came back to this topic. Manual Audit...

Exploit for Missing Authorization in Linuxfoundation Harbor

Ary Ary 是一个集成类工具，主要用于调用各种安全工具，从而形成便捷的一键式渗透。 版本：2.1.1 公开版 作者： Ali0th 联系： [email protected] 主页： github.com/Martin2877 声明：本工具仅供学习、测试使用，严禁用于非法用途，开发者对使用者的违法行为不负责任。 交流：欢迎提issue，或私信我加入工具使用交流群。 下载 前往releases下载 相关文档 我的一键 getshell 代码开发之路v1.8.pdf 功能 注意，部分功能还在开发中 0. 信息收集工具开发中 1. 通过多个网络空间的搜索引擎批量爬取相应网站, 如...

SUSE-SU-2021:0435-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2020-15257: Fixed a privilege escalation in containerd bsc1178969. - CVE-2021-21284: potential privilege escalation when the root user in the remapped namespac...

Privilege Escalation

snapd is vulnerable to privilege escalation. When generating the systemd service units for the docker snap and other similar snaps, snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daem...

Security Bulletin: IBM Security Verify Information Queue does not properly encode error messages sent to web users (CVE-2021-20405)

Summary When an error occurs while using the IBM Security Verify Information Queue ISIQ web application, the status messages sent back to the user are not properly encoded. This could lead to information disclosure, which could then be leveraged in a phishing attack. As of v10.0.0, the ISIQ web...

Security Bulletin: IBM Security Verify Information Queue still supports older browsers that don't enforce CSRF token protections (CVE-2021-20403)

Summary The IBM Security Verify Information Queue ISIQ web application protects against cross-site request forgery CSRF attacks by using the SameSite cookie attribute. However, ISIQ's web browser requirements are not current enough to ensure that this cookie attribute gets consistently used. As o...

Security Bulletin: IBM Security Verify Information Queue does not sufficiently protect its session cookies (CVE-2021-20404)

Summary IBM Security Verify Information Queue ISIQ does not sufficiently protect its session cookies from malicious modification. Consequently, a denial-of-service attack could cause ISIQ logins to fail with an invalid token. As of v10.0.0, ISIQ has strengthened the safeguards of session cookies...

Security Bulletin: IBM Security Verify Information Queue could reveal sensitive data in application error messages (CVE-2021-20402)

Summary In response to certain application errors, IBM Security Verify Information Queue ISIQ could output messages that contain sensitve data, which could then be used to gain unauthorized system access. As of v10.0.0, ISIQ no longer includes sensitve data when outputting error messages...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js package with known vulnerabilities (CVE-2020-11023, CVE-2020-11022)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the jQuery package that has two cross-site scripting vulnerabilities. As of v10.0.0, ISIQ has upgraded to a newer, secure version of jQuery. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuer...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js package with a cross-site scripting vulnerability (CVE-2020-7676)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the angular.js package that has a cross-site scripting vulnerability. As of v10.0.0, ISIQ has upgraded to a newer, secure version of angular.js. Vulnerability Details CVEID: CVE-2020-7676 DESCRIPTION:...

PT-2021-11381 · Canonical +1 · Snapd +2

Name of the Vulnerable Software and Affected Versions: snapd affected versions not specified Description: The issue arises when generating systemd service units for the docker snap and similar snaps, as snapd fails to specify Delegate=yes. As a result, systemd moves processes from containers...