Insecure Default Configuration

tripleoheattemplates is vulnerable to insecure default configuration. The vulnerabilty exists due to the default configuration set for the OpenDayLight ODL admin users' credentials, allowing malicious users to gain unauthorized access...

Default credentials

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

UBUNTU-CVE-2018-10898

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

PYSEC-2018-102

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

PYSEC-2018-102

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

CVE-2018-10898

CVE-2018-10898 affects openstack-tripleo-heat-templates prior to 8.0.2-40. When deploying with Director in RHOSP13, Opendaylight is configured with easily guessable default credentials, as described in multiple sources (Red Hat RHSA-2018:2214 and CNVD/OSV entries). The issue arises from default c...

UBUNTU-CVE-2017-2621

An access-control flaw was found in the OpenStack Orchestration heat service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information...

CVE-2017-2621

The CVE-2017-2621 issue affects OpenStack Orchestration (Heat) prior to 8.0.0 (and 6.1.0, 7.0.2 in older branches): a service log directory was world-readable, allowing a local attacker to access sensitive information. Connected advisories confirm Heat-related fixes and updates (e.g., RHSA notes ...

PT-2018-7142 · Openstack · Openstack Orchestration (Heat) Service

Name of the Vulnerable Software and Affected Versions: OpenStack Orchestration heat service versions prior to 8.0.0 OpenStack Orchestration heat service version 6.1.0 OpenStack Orchestration heat service version 7.0.2 Description: An access-control flaw was found in the OpenStack Orchestration he...

Important: Red Hat Security Advisory: openstack-tripleo-heat-templates security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 13.0 Queens for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

HackRF Circuit Board - New Universal Case for PenTests

Document Title: =============== HackRF Circuit Board - New Universal Case for PenTests References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2134 Download: https://www.vulnerability-lab.com/resources/documents/2134.rar Vulnerability Magazine:...

Recovering Keyboard Inputs through Thermal Imaging

Researchers at the University of California, Irvine, are able to recover user passwords by way of thermal imaging. The tech is pretty straightforward, but it's interesting to think about the types of scenarios in which it might be pulled off. Abstract: As a warm-blooded mammalian species, we huma...

HackRF Circuit Board - New Universal Case for PenTests

Document Title: =============== HackRF Circuit Board - New Universal Case for PenTests References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2134 Download: https://www.vulnerability-lab.com/resources/documents/2134.rar Vulnerability Magazine:...

stahls.com XSS vulnerability

Open Bug Bounty ID: OBB-641031 Description| Value ---|--- Affected Website:| stahls.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...

Moderate: Red Hat Security Advisory: openstack-tripleo-common and openstack-tripleo-heat-templates update

An update for openstack-tripleo-common and openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

Heat Map Released by Fitness Tracker Reveals Location of Secret Military Bases

Every one of us now has at least one internet-connected smart device, which makes this question even more prominent —how much does your smart device know about you? Over the weekend, the popular fitness tracking app Strava proudly published a "2017 heat map" showing activities from its users arou...

World Readable Data

tripleo-heat-templates contains a world readable data vulnerability. The library does not set the proper permissions during the creation of the ceph.client.openstack.keyring, allowing a local user to access the keyring to read or modify data. This vulnerability only affects setups with openstack...

openstack-tripleo-heat-templates package information disclosure vulnerability

The openstack-triple-heat-templates package is a set of generic template packages that support installation, upgrades, and other operations on the Openstack platform using the Openstack Cloud Facility. A security vulnerability exists in the openstack-tripleo-heat-templates package that stems from...

UBUNTU-CVE-2017-12155

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...