GenericSetup 信息泄露漏洞

GenericSetup is an open source mini-framework for representing the configuration state of a Zope Site as a set of file system artifacts. An information disclosure vulnerability exists in versions of GenericSetup prior to 2.1.1 that stems from allowing an anonymous visitor to potentially view log...

PT-2021-17412 · Grafana +6 · Grafana +6

Name of the Vulnerable Software and Affected Versions: Grafana versions 6.7.3 through 7.4.1 Description: The snapshot feature in Grafana can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. This issue is related...

CVE-2021-21120

Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

IBM Security Identity Governance and Intelligence信息泄露漏洞

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. An information disclosure vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. A local attacker could exploit this vulnerability to obtain sensitiv...

CentOS 8 : grafana (CESA-2020:1659)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1659 advisory. - grafana: incorrect access control in snapshot HTTP API leads to denial of service CVE-2019-15043 Note that Nessus has not tested for this issue but has instea...

Updated crmsh packages fix security vulnerability

The crm configure and hbreport commands failed to sanitize sensitive information by default bsc1163581. An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" when "crm" is run were able to execute commands via shell code injection to the crm histor...

Nagios Log Server Cross-Site Scripting Vulnerability (CNVD-2021-05455)

Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. Nagios Log Server version 2.1.7 cross-site scripting vulnerability, the vulnerability stems from the nagioslogserver configuration snapshotname parameter is not filtered for user input, an...

CVE-2020-8569

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...

CVE-2020-8569

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...

Design/Logic Flaw

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...

CVE-2020-8569 Kubernetes CSI snapshot-controller DoS

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...

CVE-2020-8569

CVE-2020-8569 affects the Kubernetes CSI external snapshot-controller when processing a VolumeSnapshot CR that references a non-existent PersistentVolumeClaim and lacks a VolumeSnapshotClass. The root cause is a NULL pointer dereference which can cause the snapshot-controller to crash and, after ...

Kubernetes Code Issues Vulnerabilities

Kubernetes is an open source Docker container cluster management system from the Linux Foundation. The system provides resource scheduling, deployment operations, service discovery, and scaling up and down for containerized applications. A code issue vulnerability exists in Kubernetes CSI...

CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...

CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...

CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...

Nagios Log Server 跨站脚本漏洞

Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. Nagios Log Server version 2.1.7 cross-site scripting vulnerability, the vulnerability stems from the nagioslogserver configuration snapshotname parameter is not filtered for user input, an...

IBM HTTP Server 7.0.0.0 <= 7.0.0.43 / 8.0.0.0 <= 8.0.0.14 / 8.5.0.0 < 8.5.5.14 / 9.0.0.0 < 9.0.0.8 Multiple Vulnerabilities (569301)

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, including the following: - IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which cou...

mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...

CVE-2020-27900

An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...