Moderate: Red Hat Security Advisory: OpenShift Container Storage 3.11.z Container Images Security and Bug Fix Update

Updated container images that fix various bugs are now available for Red Hat OpenShift Container Storage 3.11 Update 8 in the Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score,...

Virtuozzo Hybrid Infrastructure 4.6 Hotfix 2 (4.6.0-213)

This update provides stability fixes for the storage, Backup Gateway and object storage services. Vulnerability id: VSTOR-44694 A stability fix for the storage service. Vulnerability id: VSTOR-44859 A stability fix for the Backup Gateway service. Vulnerability id: VSTOR-44677 Complete multipart...

Virtuozzo Hybrid Infrastructure 4.5 Update 1 Hotfix 3 (4.5.1-42)

This update provides fixes for the storage and compute services. Vulnerability id: VSTOR-43250 Load balancer members are not displayed in the self-service panel. Vulnerability id: VSTOR-43236 A Kubernetes VM's system disk may be out of space due to Podman logs. Vulnerability id: VSTOR-41499...

CVE-2021-29043

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middl...

ceph: specially crafted XML payload on POST requests leads to DoS by crashing RGW

A flaw was found in the Ceph Object Gateway S3 API, where it did not properly validate the POST requests. This flaw allows an attacker to perform a denial of service attack using a malicious POST request with specially crafted XML payload, leading to a crash of the RGW process...

Automox Alive Automox Agent 安全特征问题漏洞

Automox Alive Automox Agent is an application from the Automox Alive community. An agent software. An Access Control Error vulnerability exists in versions prior to Automox Agent 31 that stems from the use of inadequately protected S3 bucket endpoints to store sensitive files, which can be...

rubygem-activestorage: circumvention of file size limits in ActiveStorage

A flaw was found in rubygem-activestorage. The ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. The highest threat from this vulnerability is to data integrity...

openSUSE: Security Advisory for ceph (openSUSE-SU-2021:0079-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Virtuozzo Hybrid Infrastructure 4.5 (4.5.0-284)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance the end-user experience and service providers' interoperability. The improvements cover compute services, networking, storage core, monitoring, and the administrative user interface. Additionally,...

openSUSE Security Update : ceph (openSUSE-2021-79)

This update for ceph fixes the following issues : Security issues fixed : - CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1179802 bsc1180155. Non-security issues fixed : - Fixes an issue when check in legacy collection reaches end. bsc1179139 - Fixes an...

SkyCloud disk PC client for windows has dll hijacking vulnerability

Tianyi Cloud Drive is a cloud storage service product launched by China Telecom for individual and family users, positioning itself as a "data center for individuals and families", and providing cloud storage services such as cell phone album backup, multi-end file sharing, family album sharing,...

360 Secure Cloud Drive Windows interface version suffers from dll hijacking vulnerability (CNVD-2021-10428)

360 Secure Cloud Disk is a product that provides cloud storage and file sharing services for a wide range of real-name personal and business users. 360 Secure Cloud Disk Windows interface version of the dll hijacking vulnerability, attackers can use the vulnerability to cause the user's computer ...

Security update for ceph (moderate)

openSUSE Security Update: Security update for ceph Announcement ID: openSUSE-SU-2021:0079-1 Rating: moderate References: 1178837 1179139 1179452 1179802 1180118 1180155 Cross-References: CVE-2020-27781 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has 5 fixes i...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2021:0023-1)

This update for ceph fixes the following issues : Security issues fixed : CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1179802 bsc1180155. Non-security issues fixed : Fixes an issue when check in legacy collection reaches end. bsc1179139 Fixes an issue...

SUSE-SU-2021:0023-1 Security update for ceph

This update for ceph fixes the following issues: Security issues fixed: - CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1179802 bsc1180155. Non-security issues fixed: - Fixes an issue when check in legacy collection reaches end. bsc1179139 - Fixes an...

Command Injection

Overview s3-kilatstorage is a S3 client for NodeJs 8.X or greater. KilatStorageS3 uses a bash command to run s3cmd which has been configured and connected to the kilatstorage service. You can use this package for Amazon S3 service too. Affected versions of this package are vulnerable to Command...

CVE-2020-26816

SAP AS JAVA Key Storage Service, versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access ...

Information disclosure

SAP AS JAVA Key Storage Service, versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access ...

CVE-2020-26816

The CVE-2020-26816 issue affects SAP NetWeaver AS Java Key Storage Service. Key material is stored in DER-encoded format in the database and is not encrypted, enabling an administrator to decode the keys and potentially access application data and client credentials of adjacent systems, impacting...

SAP AS JAVA 安全漏洞

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP Netweaver AS JAVA Key Storage Service versions 7.10, 7.11,...