Authentication flaw

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

CVE-2020-0368

In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This could lead to local information disclosure of voicemail metadata with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-0486

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...

CVE-2020-0479

In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app to access files available to the DocumentProvider without user permission, with no additional execution privileges needed. User interaction...

CVE-2020-0486

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...

Dex Idp Dex Security Breach

Dex Idp Dex is a Go-based language from the Dex Idp team that provides for plug-and-play OpenId authentication and Oauth authentication. A vulnerability exists in the SAML connector in Dex Idp Dex. The vulnerability stems from an error in SAML validation that allows an attacker to bypass SAML...

Siemens USA CISO: 3 essentials to look for in a cloud provider

In the latest episode of my series, The Shiproom, I spoke with Kurt John, Chief Cybersecurity Officer CISO at Siemens USA. Kurt is listed in Security Magazine’s Top 10 most influential cybersecurity leaders, and he also serves on a special cybersecurity committee organized by the...

Siemens USA CISO: 3 essentials to look for in a cloud provider

In the latest episode of my series, The Shiproom, I spoke with Kurt John, Chief Cybersecurity Officer CISO at Siemens USA. Kurt is listed in Security Magazine’s Top 10 most influential cybersecurity leaders, and he also serves on a special cybersecurity committee organized by the...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and packages update

Red Hat OpenShift Container Platform release 4.6.8 is now available with updates to packages and images that fix several bugs. An update for ironic-images, openshift, openshift-ansible, openshift-clients, and python-eventlet, cri-o, openshift-kuryr, python-pyroute2 is now available for Red Hat...

kubernetes: Secret leaks in kube-controller-manager when using vSphere Provider

A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log...

Secret leaks in logs for vSphere Provider kube-controller-manager

...

Code injection

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects v1.19.3...

CVE-2020-8563

CVE-2020-8563 describes a local-information leak in Kubernetes clusters using the vSphere cloud provider: when kube-controller-manager runs with logLevel >= 4, VSphere credentials can be written to logs. The issue affects Kubernetes versions prior to 1.19.3 (as stated in the description). Conn...

CVE-2020-8563

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects v1.19.3...

Inclusion of Sensitive Information in Log Files

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log...

Threat and Vulnerability Management Best Practices

Today’s business world is increasingly driven by e-commerce and the cloud, which means it requires a proactive approach toward vulnerability management. After all, your company’s data—as well as your customers’—remains at risk to cybercriminals, which places the onus on you to protect your...

CVE-2020-14302

A flaw was found in Keycloak, where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

Red Hat Keycloak Security Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Keycloak that originates when, after successful authentication, an external identity provider redirects to a...

The vulnerability of the Windows Client Side Rendering Print Provider component allows attackers to exploit their privileges.

The vulnerability of the Windows Client Side Rendering Print Provider component is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...