kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information

A server side request forgery SSRF flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master's host network. This can include secrets from the...

Cops Take Over a Botnet to Clear Malware Off Nearly a Million PCs

Attacking Iran, a web host data breach, and more of the week's top security news...

The vulnerability of the network software SKS Keyserver and the GNU Privacy Guard (GnuPG) software for encrypting information and generating digital signatures arises from the lack of verification of host data in the certificates. This allows attackers to trigger a service failure.

The vulnerability of the network software SKS Keyserver and the information encryption and digital signatures generation programs of GNU Privacy Guard GnuPG is related to the lack of verification of host data in the certificates. Exploiting this vulnerability could allow a malicious actor to caus...

Apache OFBiz Information Disclosure Vulnerability (CNVD-2018-25797)

Apache OFBiz also known as Apache Open For Business Project is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security vulnerability exists in Apache OFBiz...

Security Bulletin: OpenStack Nova vulnerabilities affect IBM Cloud Manager with OpenStack (CVE-2016-2140)

Summary IBM Cloud Manager with Openstack is vulnerable to a OpenStack Nova vulnerablities. An attacker could exploit this vulnerability to obtain sensitive information by a host data leak in resize/migration. Vulnerability Details CVEID: CVE-2016-2140 DESCRIPTION: OpenStack Nova could allow a...

DEBIAN-CVE-2017-15589

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS or an arbitrary guest OS because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory...

ALPINE-CVE-2017-15589

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS or an arbitrary guest OS because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory...

SUSE-SU-2016:3067-1 Security update for xen

xen was updated to version 4.7.1 to fix 17 security issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host bsc1011652. - CVE-2016-9386: x86 null segments were not always treated as...

guest 32-bit ELF symbol table load leaking host data

ISSUE DESCRIPTION Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load kernel symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused...

Qemu Information Disclosure Vulnerability (CNVD-2016-02391)

QEMU is a suite of analog processor software. A vulnerability in Qemu's kvmvapic.c when using Task Priority Register TPR optimization allows a local attacker to exploit the vulnerability to obtain host-sensitive information...

openstack-nova: Unprivileged API user can access host data using instance snapshot

A flaw was discovered in the OpenStack Compute nova snapshot feature when using the libvirt driver. A compute user could overwrite an attached instance disk with a malicious header specifying a backing file, and then request a snapshot, causing a file from the compute host to be leaked. This flaw...

openstack-cinder: Cinder-volume host data leak to virtual machine instance

The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...

openstack-cinder: Cinder-volume host data leak to virtual machine instance

The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...

GLSA-201407-03 : Xen: Multiple Vunlerabilities

The remote host is affected by the vulnerability described in GLSA-201407-03 Xen: Multiple Vunlerabilities Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact : A remote attacker can utilize multiple vectors to execute...

DEBIAN-CVE-2014-4044

OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service uninitialized memory access and crash via unspecified vectors related to TMAY requests...

A Problem of CPU Consumption in Host Data Collector bundled with Hitachi Device Manager Software

Overview Host Data Collector bundled with Hitachi Device Manager Software contains a problem of CPU consumption. Impact When Host Data Collector receives a malicious unexpected request, a process of Host Data Collector might consume CPU resources. Solution Please refer to the 'Vendor Information'...

CVE-2009-5117

The Web Post Protection feature in McAfee Host Data Loss Prevention DLP 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files...

CVE-2009-5117

The CVE-2009-5117 entry concerns McAfee Host Data Loss Prevention (DLP) with its Web Post Protection feature. Versions 3.x prior to 3.0.100.10 and 9.x prior to 9.0.0.422, when HTTP Capture mode is enabled, may let local users obtain sensitive information from web traffic by reading unspecified fi...

PT-2012-1282

Name of the Vulnerable Software and Affected Versions McAfee Host Data Loss Prevention DLP versions 3.x before 3.0.100.10 McAfee Host Data Loss Prevention DLP versions 9.x before 9.0.0.422 Description The issue allows local users to obtain sensitive information from web traffic by reading...

CVE-2009-5117: Exposure of Sensitive Information to an Unauthorized Actor

The Web Post Protection feature in McAfee Host Data Loss Prevention DLP 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files...