Security Bulletin: IBM Spectrum Scale for IBM Elastic Storage Server is affected by the use of Local Read Only Cache (LROC) which may result in directory corruption and undetected data corruption in regular files.

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale where after cached data is moved from memory to the LROC device, any changes to that data should trigger invalidation of the data stored in LROC. Due to a problem with invalidation logic, it is possible for th...

Best Practice: SFC(System File Checker) use in App Layering

Where to execute an sfc check? The best practice is to execute the SFC tool in the Gold Image, prior to creating your first OS Layer. This should ensure the future OS layers are free of Windows file corruption. When needed, a version can be removed and a new version created. Other options are, in...

LeakLooker - Find Open Databases With Shodan

Find open databases with Shodan Background: https://medium.com/@wojciech/leaklooker-find-open-databases-in-a-second-9da4249c8472 Requirements: Python 3 Shodan paid plan, except Kibana search Put yourShodan API key in line 65 pip3 install shodan pip3 install colorama pip3 install hurry.filesize...

Security Bulletin: The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1782)

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale which could allow a local, unprivileged user to cause a kernel panic on a node running GPFS by accessing a file that is stored on a GPFS file system with mmap, or by executing a crafted file stored on a GPFS...

Security Bulletin: The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1783)

Summary The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale which could allow an unprivileged, authenticated user with access to a GPFS node to forcefully terminate GPFS and deny access to data available through GPFS CVE-2018-1783. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale packaged in IBM Elastic Storage Server (CVE-2018-12539)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Elastic Storage Server. This issue was disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to...

Infection Monkey v1.6 - An Automated Pentest Tool

The Infection Monkey is an open source security tool for testing a data center's resiliency to perimeter breaches and internal server infection. The Monkey uses various methods to self-propagate across a data center and reports success to a centralized Monkey Island server. The Infection Monkey i...

com.amazon.emr:hive2-shims (>=5.0.0 <=5.6.0), com.boozallen.aissemble:extensions-data-delivery-spark (>=1.13.0-rc6 <=2.0.0) +59 more potentially affected by CVE-2018-1315 via org.apache.hive:hive-exec (>=2.1.0 <=2.3.2)

org.apache.hive:hive-exec MAVEN version =2.1.0, =5.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =4.1.2-RELEASE, =4.0.0-preview22.0.1, =5.6.0, =4.1.0, =4.0.00.31.1-prerelease6, =4.0.0, =4.1.0, =4.2.0 and more Source cves: CVE-2018-1315 Source advisory: OSV:GHSA-P639-XXV5-J...

Elastic Kibana <= 5.6.12 / >= 6.0.0, <= 6.4.2 File Inclusion Vulnerability - Linux

Elastic Kibana is prone to a file inclusion vulnerability. This VT has been deprecated as a duplicate of the following VT: Elastic Kibana 5.0 = 6.0.0, = 6.4.2 File Inclusion Vulnerability - Linux"; scriptcategoryACTGATHERINFO; scriptcopyright"Copyright C 2018 Greenbone AG"; scriptfamily...

Elastic Kibana <= 5.6.12 / >= 6.0.0, <= 6.4.2 File Inclusion Vulnerability - Windows

Elastic Kibana is prone to a file inclusion vulnerability. This VT has been deprecated as a duplicate of the following VT: Elastic Kibana 5.0 = 6.0.0, = 6.4.2 File Inclusion Vulnerability - Windows"; scriptcategoryACTGATHERINFO; scriptcopyright"Copyright C 2018 Greenbone AG"; scriptfamily"Web ap...

Unspecified Vulnerability in Oracle PeopleSoft Products PeopleSoft Enterprise PeopleTools Component (CNVD-2019-28243)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, and more.PeopleSoft Enterprise PeopleTools is one of the tools and technology platform components that...

CVE-2018-3164

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Elastic Search. Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSo...

CVE-2018-3164

CVE-2018-3164 affects Oracle PeopleSoft PeopleTools Elastic Search subcomponent in PeopleSoft Enterprise PeopleTools (versions 8.55 and 8.56). An unauthenticated attacker with network access via HTTP can compromise data; attacks reportedly require user interaction, and may lead to unauthorized re...

CVE-2018-3164

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Elastic Search. Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSo...

Elastic Kibana 'CVE-2018-3830' Cross-Site Scripting (XSS) Vulnerability - Windows

Kibana is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Elastic Cloud Enterprise (ECE) Information Disclosure Vulnerability (CNVD-2019-17471)

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. An information disclosure vulnerability exists in Elastic Cloud Enterprise ECE, which can be exploited by an attacker to access...

Elastic Cloud Enterprise (ECE) Incorrect Authentication Vulnerability

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. Elastic Cloud Enterprise ECE suffers from an incorrect authentication vulnerability that can be exploited by an attacker to add ...

Pivotal Cloud Foundry Elastic Runtime Information Disclosure Vulnerability (CNVD-2018-19741)

Pivotal Cloud Foundry PCF is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.Elastic Runtime is a runtime environment for Pivotal Cloud Foundry. Elastic Runtime is a...

Elastic Cloud Enterprise (ECE) Information Disclosure Vulnerability

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. An information disclosure vulnerability exists in Elastic Cloud Enterprise ECE, which can be exploited by an attacker to obtain...

Elastic X-Pack Machine Learning Cross-Site Scripting Vulnerability

Elastic X-Pack is an extension of the Elastic Stack log analytics system from Elasticsearch in the Netherlands.X-Pack Machine Learning is one of the machine learning components. A cross-site scripting vulnerability in Elastic X-Pack Machine Learning versions prior to 6.2.4 and prior to 5.6.9 can ...