721 matches found
PT-2021-13798
Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 32 in the controller server service. An unauthenticated remote attacker on the same network ca...
Gryphon Tower operating system command injection vulnerability
The Gryphon Tower is a wireless router from Gryphon. A command injection vulnerability exists in Gryphon Tower, which originates from the failure of the parameters of operation 3 in the controllerserver service on the router to correctly filter special characters, commands, etc. entered by the...
PT-2021-13802
Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: The issue concerns an unprotected openvpn configuration file in Gryphon Tower routers, which can allow attackers to access the Gryphon homebound VPN network. This exposure can...
PT-2021-13794
Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: A reflected cross-site scripting issue exists in the url parameter of the "/cgi-bin/luci/site access/" page on the Gryphon Tower router's web interface. An attacker could explo...
Gryphon Tower security vulnerability
Gryphon Tower is a wireless router from Gryphon, Inc. Gryphon Tower is vulnerable to an information disclosure vulnerability stemming from the presence of an unprotected ssh private key on the device, which could be exploited by an attacker to gain root access to servers belonging to Gryphon's...
PT-2021-13799
Name of the Vulnerable Software and Affected Versions: Gryphon Tower routers affected versions not specified Description: An unauthenticated command injection issue exists in the parameters of operation 41 in the controller server service. An unauthenticated remote attacker on the same network ca...
Gryphon Tower operating system command injection vulnerability
A command injection vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from the failure to properly filter the parameters of operation 41 in the controllerserver service on the router for special characters and commands entered by the user, which could ...
Updated ansible packages fix security vulnerability
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...
Important: Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container
Red Hat Ansible Tower 3.8.4-1 - Container Running inventories of 60k hosts no longer takes a very long time for events to show up Removed artifactdata from data sent to analytics as part of playbookonstats, since artifactdata can contain PII or sensitive data Regular users are no longer...
AWS Marketplace Talks Secure Digital Transformation
Spurred on by the pandemic, digital transformation continues to accelerate. Chris Grusz, director of AWS Marketplace and Control Tower, discusses how security teams can leverage this transformation to securely innovate and drive better business outcomes...
Privilege Escalation
ansible-tower is vulnerable to privilege escalation. The vulnerability exists due to application credentials exposed to playbook job runs via environment variables...
CVE-2021-3533
Rejected reason: This vulnerability does not meet the criteria for a security vulnerability...
PYSEC-2021-125
A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...
gufo-tower (2.0.0) potentially affected by CVE-2021-3533 via ansible (2.9.26)
ansible PYPI version 2.9.26 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - gufo-tower 2.0.0 Source cves: CVE-2021-3533 Source advisory: OSV:PYSEC-2021-126...
PYSEC-2021-126
A flaw was found in Ansible if an ansible user sets ANSIBLEASYNCDIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async...
PYSEC-2021-125
A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...
CVE-2021-3533
CVE-2021-3533 refers to a race condition in Ansible’s async code that could allow a local authenticated attacker to obtain sensitive information. Connected sources identify affected products as Ansible Tower 3.7 and Ansible Automation Platform 1.2, with exploitation tied to setting the ANSIBLE AS...
CVE-2021-3533
Removed by vendor...
CVE-2021-3532
CVE-2021-3532 entry is corroborated by connected documents indicating a data leak in Ansible where secret information in async_files can be disclosed when the jobdir is changed to a world-readable directory. The vulnerability affects Ansible Tower 3.7 and Ansible Automation Platform 1.2, and is d...