SUSE-SU-2021:2295-1 Security update for slurm_20_11

This update for slurm2011 fixes the following issues: Updated to 20.11.7 Summary of new features: CVE-2021-31215: Fixed a remote code execution as SlurmUser bsc1186024. slurmd - handle configless failures gracefully instead of hanging indefinitely. select/constres - fix Dragonfly topology not...

Lazarus Targets Job-Seeking Engineers with Malicious Documents

The notorious Lazarus advanced persistent threat APT group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. The ploy involves impersonating defense contractors seeking job candidates. Researchers have been tracking Lazarus activity for...

CoolCollege has an information breach

CoolCollege is a course service platform tailored for various companies. The software enhances learning efficiency and more through 36 scenarios such as course creation, assignment tracking, data analysis, and job certification. An information disclosure vulnerability exists in CoolCollege, which...

#Rapid7Life Belfast: Why I Joined

Starting a new job at a new company can be daunting, particularly during a global pandemic. With interviews via Zoom, onboarding gone remote, first days at home instead of in a brand new office, and so many other shifts since the onset of the pandemic, switching jobs and companies is probably not...

Security Bulletin: IBM Spectrum Protect Plus has Insecure File Permissions due to not setting the Sticky Bit (CVE-2021-20490)

Summary IBM Spectrum Protect Plus has several directories that are failing security scans due to the sticky bit not being set on world-writable files. Vulnerability Details CVEID: CVE-2021-20490 DESCRIPTION: IBM Spectrum Protect Plus could allow a local user to cause a denial of service due to...

WebMO Job Manager v20.0 - Cross Site Web Vulnerability

Document Title: =============== WebMO Job Manager v20.0 - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2270 Release Date: ============= 2021-06-21 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Privilege Escalation

ansible-tower is vulnerable to privilege escalation. The vulnerability exists due to application credentials exposed to playbook job runs via environment variables...

CVE-2020-22203

SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php...

CVE-2021-21667

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission...

CVE-2021-21667

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission...

PHPCMS SQL注入漏洞

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, images, downloads, information, products and so on. A SQL injection vulnerability exists in phpCMS because the genre parameter in the yp/job.php file is not handled securely,...

PT-2021-14710 · Jenkins · Jenkins Scriptler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Scriptler Plugin versions 3.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This is due to the plugin not escaping parameter names shown in job configuration forms. Attackers with...

Stored XSS vulnerability in scriptler

scriptler 3.2 and earlier does not escape parameter names shown in job configuration forms. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission. scriptler 3.3 escapes parameter names shown in job configuration forms...

Security Bulletin: Security vulnerability in WebSphere Application Server shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary IBM WebSphere Application Server is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. WebSphere Application Server is vulnerable to a directory traversal vulnerability. Vulnerability Details Refer to the security bulletins listed in the...

HashiCorp Nomad Remote Command Execution Exploit

This Metasploit module lets you create a batch job on HashiCorp's Nomad service to spawn a shell. The default option is to use the rawexec driver, which runs with high privileges. Development servers and clients explicitly enabling the rawexec plugin can spawn these type of jobs. Regular exec job...

HashiCorp Nomad Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HashiCorp Nomad Remote Command Execution', 'Description' = %q Create a batch job on HashiCorp's Nomad service to spawn a shell. The default optio...

CVE-2020-2161

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels...

PYSEC-2021-125

A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...

SUSE: Security Advisory (SUSE-SU-2020:1580-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Information Exposure

Overview foremanansible is an Ansible integration with Foreman. Affected versions of this package are vulnerable to Information Exposure. A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious...