Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw...

Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw...

PYSEC-2020-268

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

PYSEC-2020-210

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl...

PT-2020-6569

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x prior to 2.7.17 Ansible Engine versions 2.8.x prior to 2.8.11 Ansible Engine versions 2.9.x prior to 2.9.7 Description A security flaw was found in Ansible Engine when managing Kubernetes using the k8s module...

novnc: XSS vulnerability via the messages propagated to the status field

An XSS vulnerability was discovered in noVNC in which arbitrary HTML could be injected into the noVNC web page. An attacker having access to a VNC server could use target host values in a crafted URL to gain access to secure information such as VM tokens...

OpenStack Nova Token Disclosure Vulnerability

OpenStack is a cloud platform management program.OpenStack Nova is one of the cloud computing structure controllers. A security vulnerability exists in OpenStack Nova versions prior to 18.2.4, 19.x versions prior to 19.1.0, and 20.x versions prior to 20.1.0, which stems from a program placing...

UBUNTU-CVE-2020-1692

Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course...

PYSEC-2020-213

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

USN-4224-1 python-django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...

CVE-2019-17590

The csrfcallback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and dispersing it to a victim via social engineering, enticing them...

PT-2021-8980 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.7 through 3.7.1 Moodle versions 3.6 through 3.6.5 Moodle versions 3.5 through 3.5.7 Moodle versions prior to 3.5 Description: A vulnerability was found in the mobile launch endpoint, which contained an open redirect in some...

CVE-2019-4284

IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512...

PT-2020-3606 · Saltstack +3 · Saltstack Salt +3

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 2019.2.4 SaltStack Salt versions 3000 prior to 3000.2 Description: An issue was discovered in the salt-master process ClearFuncs class, which does not properly validate method calls. This allows a remote user ...

curl: HTTP authentication leak in redirects

It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities...

CVE-2019-10041

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication...

Session fixation

Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted to a session...

Pivotal Concourse Token Disclosure Vulnerability

Pivotal Concourse is a software delivery control system for continuous development from Pivotal Software. A security vulnerability exists in Pivotal Concourse versions prior to 4.2.2, which originates when the program places a user's access token in a URL. A remote attacker can exploit this...

Adobe Connect <= 9.8.1 Exposure Of The Privileges Granted To A Session Vulnerability (APSB19-05)

The version of Adobe Connect installed on the remote host is prior to 10.1.0. It is, therefore, affected by a vulnerability as referenced in the apsb19-05 advisory. - Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposu...

Adobe Patches Important Bugs in Connect and Digital Edition

Adobe released patches for two bugs rated “important” in its Adobe Digital Edition and Adobe Connect products. The two important vulnerabilities, patched Tuesday, include an information disclosure bug in Adobe’s ebook reader software program, Digital Edition; as well as a session token exposure b...