Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-twisted) security update

An update for python-twisted is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Jenkins Plugin Semantic Versioning 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An access control error vulnerability exis...

SUSE: Security Advisory (SUSE-SU-2022:0734-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0734-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects bsc1195667, GHSA-92x2-jw7w-xvvx from...

SUSE-SU-2022:0499-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects by properly removing sensitive headers when redirecting to a different origin bsc1195667...

OPENSUSE-SU-2022:0499-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects by properly removing sensitive headers when redirecting to a different origin bsc1195667...

Agent-to-controller security bypass in hashicorp-vault-plugin

hashicorp-vault-plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent. This allows attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key. The functionality that allow agen...

CVE-2021-43053 TIBCO FTL Secret Exposure Vulnerability

The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a difficult to exploit vulnerability that allows an unauthenticated attacker with network access to obtain the cluster secret of another...

TIBCO Security Advisory: January 11, 2022 - TIBCO FTL -2021-43053

TIBCO FTL Secret Exposure Vulnerability Original release date: January 11, 2022 Last revised:--- CVE-2021-43053 Source: TIBCO SoftwareInc. Products Affected TIBCO FTL - Community Edition versions 6.7.2 and below TIBCO FTL - Developer Edition versions 6.7.2 and below TIBCO FTL - Enterprise Edition...

Medium: docker

Issue Overview: Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemonunix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. CVE-2018-20699 A command injectio...

PT-2021-23881 · Jenkins · Jenkins Pom2Config Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins pom2config Plugin versions 1.2 and earlier Description: The issue allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the...

GHSA-862G-9H5M-M3QV coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config. Default configurations of Fedora CoreOS and RHEL...

Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue has been rated High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, and assigned CVE-2021-25742...

CVE-2021-42087

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...

GHSA-5PH6-QQ5X-7JWC ExternalName Services can be used to gain access to Envoy's admin interface

Impact Josh Ferrell @josh-ferrell from VMware has reported that a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely a denial of service, o...

MAC1100 PLC 信息泄露漏洞

The MAC1100 PLC is an industrial control product PLC. The MAC1100 PLC is vulnerable to an information disclosure vulnerability that could allow an attacker to remotely download control code from the PLC.The control code in the PLC could be a core company secret...

PT-2021-22206 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.8.0 HashiCorp Vault and Vault Enterprise versions 1.7.x prior to 1.7.4 HashiCorp Vault and Vault Enterprise versions 1.6.x prior to 1.6.6 Description: The UI of HashiCorp Vault and Vaul...

CVE-2021-32783

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...

CVE-2021-32783 Authorization bypass in Contour

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...

Design/Logic Flaw

Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and values on configuration objects in Icinga...