How to Use VSSTrace to Collect VSS Diagnostic Logging

Challenge This article explains how to collect additional VSS diagnostic data with the VSSTrace tool, a Microsoft Windows Software Development Kit SDK component. Cause Veeam products use Microsoft Volume Shadow Copy Service VSS for various tasks. Sometimes it is necessary to go through the...

CVE-2020-11009

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...

Authentication flaw

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...

CVE-2020-11009

CVE-2020-11009 affects Rundeck prior to 3.2.6. Authenticated users can craft requests to disclose Execution data, logs, and Job details they are not authorized to see (possible high confidentiality impact). Patches exist in version 3.2.6; upgrade Rundeck to 3.2.6 or apply vendor advisories (GHSA-...

UBUNTU-CVE-2019-18823

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include...

PT-2020-9988 · Htcondor · Htcondor

Name of the Vulnerable Software and Affected Versions: HTCondor versions 8.8.6 and earlier HTCondor versions 8.9.4 and earlier Description: The issue is related to Incorrect Access Control, allowing the use of a different authentication method to submit a job than the administrator has specified...

How to Migrate Veeam Agent Backup Files to Cloud Connect Repository

Purpose This article documents the available methods to migrate backup data from Standalone deployments of Veeam Agent for Microsoft Windows or Veeam Agent for Linux from a non-Cloud Connect Repository to a Cloud Connect repository, allowing the original backup job to continue utilizing that back...

Red Hat Satellite Job Invocation Authorization Issue Vulnerability

Red Hat Satellite is a system management platform from Red Hat, Inc. that extends the Linux infrastructure and provides system management capabilities such as administration, configuration, and monitoring. Red Hat Satellite is a system management platform from Red Hat, Inc. that extends the Linux...

CVE-2020-10716

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data...

CVE-2020-11506

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...

CVE-2020-11506

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...

Arbitrary file deletion

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...

CVE-2020-11506

CVE-2020-11506 affects GitLab 10.7.0 through 12.9.2. A Workhorse bypass could enable job artifact uploads and disclosure of sensitive information via request smuggling. Subcomponents implicated: GitLab Workhorse; root cause details are not explicitly provided in the included documents beyond the ...

CVE-2020-2177

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2177

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

FreeBSD : Gitlab -- Multiple Vulnerabilities (570706ff-7ee0-11ea-bd0b-001b217b3468)

Gitlab reports : NuGet Package and File Disclosure through GitLab Workhorse Job Artifact Uploads and File Disclosure through GitLab Workhorse Incorrect membership following group removal Logging of Praefect tokens Update Rack dependency Update OpenSSL dependency C Tenable Network Security, Inc. T...

rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: NuGet Package and File Disclosure through GitLab Workhorse Job Artifact Uploads and File Disclosure through GitLab Workhorse Incorrect membership following group removal Logging of Praefect tokens Update Rack dependency Update OpenSSL dependency...

Privilege Escalation

condor is vulnerable to privilege escalation. A flaw was found in the way Condor managed jobs. This could allow a user that is authorized to submit jobs into Condor to queue a job as if it were submitted by a different local user, potentially leading to unauthorized access to that user's account...

Privilege Escalation

condor is vulnerable to privilege escalation. A flaw was found in the way Condor processed user submitted jobs. It was possible for a user to submit a job in a way that could cause that job to run as a different user with access to the pool...