811 matches found
minio -- Server Side Request Forgery
Minio developers report: Thanks to @phith0n from our community upon a code review, discovered an SSRF Server Side Request Forgery in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large. All users are advised to upgrad...
MinIO Authorization Issues Vulnerability
MinIO is an open source object storage server from US-based MinIO. The product supports building infrastructures for machine learning, analytics and application data workloads. An authorization issue vulnerability exists in the MinIO admin API in versions prior to MinIO...
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
Authentication flaw
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
CVE-2020-11012
CVE-2020-11012 affects MinIO prior to RELEASE.2020-04-23T00-58-49Z. The admin API authentication bypass allows an admin access key to perform admin API operations (e.g., creating new service accounts for existing keys) without the admin secret key. The issue is documented across multiple sources ...
CVE-2020-11012 Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has bee...
PT-2020-12492 · Minio +1 · Minio +1
Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2020-04-23T00-58-49Z Description: The issue allows for an authentication bypass in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations, such as creating new service...
CloudBees Jenkins Minio Storage Plugin Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Minio Storage Plugin is used in one of the...
CVE-2019-10285
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
Design/Logic Flaw
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-10285
Affected software : Jenkins Minio Storage Plugin. Vulnerability : credentials are stored unencrypted in the global configuration file on the Jenkins master, specifically in org.jenkinsci.plugins.minio.MinioUploader.xml. Root cause : lack of encryption for stored credentials in the plugin’s config...
CVE-2019-10285
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-10285
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
PT-2019-11687 · Jenkins · Jenkins Minio Storage Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Minio Storage Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the...
Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Storage - GlusterFS and Minio
Summary Security Vulnerabilities affect IBM Cloud Private Storage - GlusterFS and Minio Vulnerability Details CVEID: CVE-2018-14618 DESCRIPTION: cURL libcurl is vulnerable to a buffer overflow, caused by an integer overflow flaw in the Curlntlmcoremknthash internal function in the NTLM...
SSE-C Cryptographic Flaw
github.com/minio/minio is vulnerable to cryptographic flaws. The vulnerability exists as there is a weakness in the derived key-encryption-key for SSE-C encrypted objects. The vulnerability allows malicious users to replace objects that are encrypted with the same client key as it was not bound t...
CVE-2018-1000538
Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling similar to CWE-774 vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-presigned requests with...
CVE-2018-1000538
Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling similar to CWE-774 vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-presigned requests with...