Code injection

An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...

CVE-2020-27900

An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...

Denial Of Service (DoS)

github.com/kubernetes-csi/external-snapshotter is vulnerable to denial of service. A NULL pointer dereference in the snapshot-controller allows an attacker to crash the application via authorized API requests...

CVE-2020-8569

A flaw was found in the Kubernetes snapshot-controller, where it is vulnerable to a denial of service attack via authorized API requests. The snapshot-controller can dereference a NULL pointer when processing a VolumeSnapshot custom resource via an authorized API request with invalid references t...

Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...

IBM UrbanCode Deploy Security Bypass Vulnerability (CNVD-2020-63484)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

Kernel update: Virtuozzo ReadyKernel patch 118.1 for Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 3.0, and Virtuozzo Hybrid Infrastructure 3.5, 4.0

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform, and Virtuozzo Hybrid Infrastructure. Vulnerability id: PSBM-121135 3.10.0-1127.8.2.vz7.151.14 to...

CVE-2020-4482

IBM UrbanCode Deploy (UCD) versions affected by CVE-2020-4482 include 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0. A security bypass vulnerability exists where an authenticated user with access to a snapshot can call REST endpoints to apply unauthorized additional statuses, effectively bypassing secur...

Security Bulletin: CVE-2020-4482 ADD SNAPSHOT STATUS REST CALL DOESN'T CHECK THE USER ROLE

Summary ADD SNAPSHOT STATUS REST CALL DOESN'T CHECK THE USER ROLE BEFORE ADDING THE STATUS TO SNAPSHOT Vulnerability Details CVEID: CVE-2020-4482 DESCRIPTION: IBM UrbanCode Deploy UCD could allow an authenticated user to bypass security. A user with access to a snapshot could apply unauthorized...

Release Information for Huawei Plug-In for Veeam Backup & Replication

Huawei Plug-In - End of Life The Huawei Plug-In for Veeam Backup & Replication reached End-of-Life on 2022-04-22 and is no longer available. Requirements Before installing Huawei Plug-In v1.0.23, ensure that you are running Veeam Backup & Replication 10.0.0.4461 or later. To check the version, op...

Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version: snapshot-controller from external-snapshotter repo ver 3.0.0 https://github.com/kubernetes-csi/external-snapshotter/releases/tag/v3.0.0...

SUSE-SU-2020:2715-1 Security update for grafana

This update for grafana fixes the following issues: - CVE-2020-11110: Fixed a stored XSS in dashboard snapshot original dashboard link bsc1174583...

Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x

By Cory Duplantis. One of the ways vulnerability researchers find bugs is with fuzzing. At a high level, fuzzing is the process of generating and mutating random inputs for a given target to crash it. In 2017, I started developing a bare metal hypervisor for the purposes of snapshot fuzzing:...

Exploit for Missing Authentication for Critical Function in Grafana

CVE-2019-15043 POC Description Proof of concept scan to c...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Input validation

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

UBUNTU-CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548, CVE-2015-8749 CVE-2015-1850)

Summary IBM SmartClound Entry is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information Vulnerability Details CVEID: CVE-2015-8749 DESCRIPTION: OpenStack Nova could allow a remote attacker to obtai...