smb mount security issue

This issue is tracked under CVE-2018-1002101 Is this a BUG REPORT or FEATURE REQUEST?: /kind bug Uncomment only one, leave it on its own line: /kind bug /kind feature What happened: user PowerShell Environment Variables to store user input string to prevent command line injection, the env var in...

PHPinfo Information Disclosure

Many PHP installation tutorials instruct the user to create a PHP file that calls the PHP function 'phpinfo' for debugging purposes, and various PHP applications may also include such a file by default. By accessing it, a remote attacker can discover a large amount of information about the remote...

Arbitrary file read vulnerability in SSH Credentials Plugin with Credentials Binding Plugin

SSH Credentials Plugin allowed the creation of SSH credentials with keys "From a file on Jenkins controller". Credentials Binding Plugin 1.13 and newer allows binding SSH credentials to environment variables. In combination, these two features allow users with the permission to configure a job to...

AWS CodeDeploy Plugin persisted possibly sensitive environment variables in job configuration

AWS CodeDeploy Plugin could persist environment variables from the last run of any project with the post-build step configured in the job's config.xml file. In some cases, this allowed users with file system access or Extended Read permission to obtain those potentially sensitive environment...

Security Bulletin: Vulnerabilities in Bash affect IBM Worklight Quality Assurance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities affecting IBM Worklight Quality Assurance WQA. Vulnerability Details | Subscribe to My...

Security Bulletin: TLS padding vulnerability affects IBM Security SiteProtector (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Security SiteProtector System and IBM Security SiteProtector Appliance. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a...

Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Transactions (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureData™ System for Transactions. Vulnerability Details CVE-ID:...

Unspecified vulnerability in noderequest

noderequest is a package of request nodes for use in Node.js. A security vulnerability exists in noderequest. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in crossenv

crossenv is a module for setting and using environment variables that supports several platforms. A security vulnerability exists in crossenv. An attacker can exploit this vulnerability to steal environment variables...

Unspecified vulnerability in ffmepg

ffmepg is a package that steals environment variables. A security vulnerability exists in ffmepg. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodecaffe

nodecaffe is a package that allows JavaScript to inspect Caffe layers and content. A security vulnerability exists in nodecaffe. An attacker could exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodemailer.js

nodemailer.js is a JavaScript implementation for sending e-mail . A security vulnerability exists in nodemailer.js. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in proxy.js

proxy.js is an HTTP proxy. A security vulnerability exists in proxy.js. An attacker can exploit this vulnerability to steal environment variables...

Unspecified vulnerability in http-proxy.js

http-proxy.js is a JavaScript-based HTTP proxy . A security vulnerability exists in http-proxy.js. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodeffmpeg

nodeffmpeg is a package for connecting FFmpeg. A security vulnerability exists in nodeffmpeg. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodemailer.js (CNVD-2018-22103)

nodemailer.js is a JavaScript implementation for sending e-mail . A security vulnerability exists in nodemailer.js. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in mongose

mongose is an embedded web server. A security vulnerability exists in mongose. An attacker can exploit this vulnerability to steal environment variables...

node-opencv design vulnerability

node-opencv is a JavaScript library for connecting to OpenCV. A security vulnerability exists in node-opencv. An attacker can exploit the vulnerability to steal environment variables...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

CVE-2018-1281

The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLCPSROOTURI and DMLCPSROOTPORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLCPSROOTURI onc...