CVE-2019-11402

In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format...

Default credentials

In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page...

Format string

In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format...

Information Disclosure

github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability exists as the in-memory cache that exists on performance standby nodes is not purged if a mount filter was used to exclude the secondary cluster. This allows an attacker to retrieve mount configuration data whic...

CVE-2019-11403

Gradle Enterprise prior to 2018.5.2 exposes the configured password in Build Cache Nodes when viewing the HTML source of the settings page. Cause: sensitive credential reflected in page source. Impact: potential disclosure of passwords to unauthorized viewers. Affected product/version: Gradle Ent...

CVE-2019-11403

In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page...

CVE-2019-11402

In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format...

PT-2019-12287 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2018.5.3 Description: The issue concerns the storage of credentials in Build Cache Nodes. In Gradle Enterprise, these nodes did not store credentials at rest in an encrypted format. Recommendations: For...

PT-2019-12288 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2018.5.2 Description: The issue allows the configured password to be reflected back when viewing the HTML page source of the settings page in Build Cache Nodes. Recommendations: For versions prior to...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a CNI security vulnerability

Summary IBM Cloud Kubernetes Service is affected by a CNI security vulnerability which could result in weaker than expected security. Vulnerability Details CVE-ID: CVE-2019-9946 Description: Kubernetes could provide weaker than expected security, caused by an interaction when paired with the...

PYSEC-2019-189

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those...

Design/Logic Flaw

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those...

CVE-2019-10876

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those...

CVE-2019-10876

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those...

openSUSE Security Update : slurm (openSUSE-2019-521)

This update for slurm to version 17.11.7 fixes the following issues : This security issue was fixed : - CVE-2018-10995: Ensure correct handling of user names and group ids bsc1095508. These non-security issues were fixed : - CRAY - Add slurmsmwd to the contribs/cray dir - PMIX - Added the direct...

Microsoft Internet Explorer Attr nodeValue Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2019-3780

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account...

Design/Logic Flaw

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account...

CVE-2019-3780 Cloud Foundry Container Runtime Leaks IAAS Credentials

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account...

Drupal CVE-2019-6340 Remote Code Execution EXP

Description This Metasploit module exploits a PHP unserialize vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also...