CVE-2013-0168

CVE-2013-0168 affects Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier. The MoveDisk command fails to properly enforce permissions on storage domains, allowing a privileged storage-domain admin to cause denial of service by consuming free space on other storage domains. The issu...

CVE-2012-6115

CVE-2012-6115 affects Red Hat Enterprise Virtualization Manager (RHEV-M) domain management tool: when using rhevm-manage-domains -action=validate on RHEV-M 3.1 and earlier, the administrative password is logged to a world-readable log file. This enables a local attacker to obtain sensitive inform...

CVE-2012-6115

The domain management tool rhevm-manage-domains in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file...

Linux Kernel 本地权限提升漏洞(CVE-2013-1767)

BUGTRAQ ID: 58177 CVECAN ID: CVE-2013-1767 Linux Kernel是Linux操作系统的内核。 支持tmpfs的Linux kernel在重新加载tmpfs时存在释放后重用漏洞，首次加载是通过mpol=M选项，但再次加载此缺失此选项，授权本地用户可利用此漏洞使系统崩溃，或者提升权限。 0 Linux kernel 3.3.x Linux kernel 2.6.36 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...

XSS vulnerabilities in ZeroClipboard

Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in ZeroClipboard. Last week I've made my research of these vulnerabilities and informed all developers previous and current of ZeroClipboard. When I've downloaded ZeroClipboard in September 2011, when I was writing my article Attacks vi...

Malawi Google ,MSN, Yahoo domains defaced by TiGER-M@TE

Famous Bangladeshi hacker TiGER-M@TE known for his big defacements strikes again! This time he teams up with another hacker 'h311 c0d3' for another big defacement campaign. According to mirror records on Zone-H, These hackers managed to deface Malawi Google, Yahoo, MSN, Windows and many more top...

Malawi Google ,MSN, Yahoo domains defaced by TiGER-M@TE

Famous Bangladeshi hacker TiGER-M@TE known for his big defacements strikes again! This time he teams up with another hacker 'h311 c0d3' for another big defacement campaign. According to mirror records on Zone-H, These hackers managed to deface Malawi Google, Yahoo, MSN, Windows and many more top...

CVE-2012-5516

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...

CVE-2012-0860

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...

CVE-2011-4316

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...

Design/Logic Flaw

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...

CVE-2012-0861

The CVE-2012-0861 issue affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to version 3.1. During host addition, the vds_installer downloads deployUtil.py and vds_bootstrap.py with curl -k, skipping SSL certificate validation. This MITM condition lets an attacker on the local networ...

CVE-2011-4316

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...

CVE-2012-5516

The CVE-2012-5516 issue affects Red Hat Enterprise Virtualization Manager (RHEV-M) around version 3.1, where moving disks between storage domains fails to properly wipe-after-delete. The underlying effect is potential information disclosure from disks not securely deleted, exploitable by a local ...

CVE-2012-2696

CVE-2012-2696 is a privilege-check flaw in the Red Hat Enterprise Virtualization Manager (RHEV-M) backend before 3.1. An authenticated attacker could issue queries against the RHEV-M SOAP or GWT APIs and read data they should not access, indicating an authorisation bypass in the back end. Connect...

CVE-2011-4316

CVE-2011-4316 affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to 3.1. The vulnerability arises because the desktop screen is not locked between SPICE sessions under certain conditions, enabling a local user with VM access to view or switch to other users’ desktop sessions via uns...

CVE-2012-5516

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...

CVE-2012-5516: Exposure of Sensitive Information to an Unauthorized Actor

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...

CVE-2012-2696: Undefined Security Weakness

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

A Look Back at 2012: The Armory

As we are mere hours away from celebrating 2013, we'd like to focus today on M-Unition's Armory channel. The Armory is the place to be if you want to be the first to find out about the latest releases, free tools and of course, our ever popular M-Trends report. The most popular posts in this...