2868 matches found
CVE-2017-14105
HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...
CVE-2017-14105
HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...
openstack-neutron: iptables not active after update
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an...
openstack-neutron: iptables not active after update
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an...
openstack-neutron: iptables not active after update
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an...
openstack-neutron: iptables not active after update
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an...
CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497
The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...
cfme: API leaks any MiqReportResult
A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...
Network outage and performance degradation after you install WMF 5.1 in Windows Server 2012 R2
Network outage and performance degradation after you install WMF 5.1 in Windows Server 2012 R2 Symptoms Assume that you use a Hyper-V Network Virtualization HNV Gateway with Routing and Remote Access Service RRAS clusters on a Windows Server 2012 R2-based server. After you install Windows...
CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497
The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...
cfme: API leaks any MiqReportResult
A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access...
Information Disclosure
github.com/openshift/origin is vulnerable to information disclosure. The vulnerability is possible because kubernetes watch cache does not return the correct data in a multi tenant environment, revealing the data of a user to another user...
Backup Copy Seeding and Mapping for Cloud Connect
Objective This article documents how to seed a Backup Copy job for use with a Cloud Repository from a Veeam Cloud Service Provider. Solution Critical Notes Starting with Veeam Backup & Replication v10, there are now two different backup copy modes: Immediate copy and Periodic copy. The mode used ...
CVE-2017-2632
A logic error in validrole in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges...
cfme: tenant administrator can create a group with higher permissions
A logic error in validrole in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges...
CVE-2017-3801
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control RBAC...
Update Rollup 9 for System Center 2012 R2 Orchestrator - Service Provider Foundation
Update Rollup 9 for System Center 2012 R2 Orchestrator - Service Provider Foundation Introduction This article describes the issues that are fixed and the features that are added in Update Rollup 9 for Microsoft System Center 2012 R2 Orchestrator - Service Provider Foundation. Additionally, this...
Update Rollup 10 for System Center 2012 R2 Orchestrator - Service Provider Foundation
Update Rollup 10 for System Center 2012 R2 Orchestrator - Service Provider Foundation Introduction This article describes the issues that are fixed in Update Rollup 10 for Microsoft System Center 2012 R2 Orchestrator - Service Provider Foundation. It also contains the installation instructions fo...
OpenStack Heat Information Disclosure Vulnerability
OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA and Rackspace, Inc. in the United States. An information disclosure vulnerability exists in OpenStack Heat, which is exploited by an authenticated attacker to obtain information...