901 matches found
Design/Logic Flaw
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
CVE-2018-9057
The CVE-2018-9057 entry affects the HashiCorp Terraform AWS provider, specifically aws/resource_aws_iam_user_login_profile.go, through v1.12.0. The underlying issue is an inappropriate PRNG algorithm and seeding, which can let remote attackers gain access by exploiting an IAM account with a weak ...
PT-2018-18819
Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Amazon Web Services AWS provider versions prior to v1.13.0, but since the exact fixed version is not specified, we consider versions prior to v1.12.0 as vulnerable, however the description only mentions through v1.12.0...
CVE-2017-10963
CVE-2017-10963 – Samsung Knox : In Knox SDS IAM and EMM 16.11 on Samsung devices, a man‑in‑the‑middle attacker can inspect traffic from a Samsung server and inject content during the update sequence, allowing installation of arbitrary apps into the Knox container without user knowledge. These app...
PT-2018-5308
Name of the Vulnerable Software and Affected Versions Knox SDS IAM and EMM version 16.11 Description A man-in-the-middle attacker can install any application into the Knox container without the user's knowledge by inspecting network traffic from a Samsung server and injecting content at a certain...
CVE-2017-10963: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Knox SDS IAM Identity Access Management and EMM Enterprise Mobility Management 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install any application into the Knox container without the user's knowledge by inspecting network traffic from a Samsung server and injecting conten...
Design/Logic Flaw
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...
CVE-2016-8520
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...
CVE-2016-8520
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...
CVE-2016-8520
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...
CVE-2016-8520
CVE-2016-8520 affects HPE Helion Eucalyptus (v4.3.0 and earlier). The root cause is improper IAM permission checks when accessing versioned S3 objects and ACLs, enabling in some cases authenticated users with S3 permissions to access versioned data. The NVD entry documents a network-vector, low c...
PT-2018-5014
Name of the Vulnerable Software and Affected Versions HPE Helion Eucalyptus versions 4.3.0 and earlier Description The issue arises from incorrect permission checks for IAM users accessing versioned objects and ACLs. As a result, authenticated users with S3 permissions may also be able to access...
CVE-2016-8520: Undefined Security Weakness
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...
PT-2017-14579
Name of the Vulnerable Software and Affected Versions Ceph versions 12.1.0 through 12.2.1 Description The issue allows remote authenticated users with "full" privileges to cause a denial of service by posting an invalid profile to the admin API. This is related to files rgw/rgw iam policy.cc,...
CVE-2017-16818
RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service assertion failure and application exit by leveraging "full" not necessarily admin privileges to post an invalid profile to the admin API, related to rgw/rgwiampolicy.cc, rgw/rgwbasictypes.h,...