kubernetes security update

1.9.1-2.1.5 - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from Orabug 27125915 1.9.1-2.1.4.dev - Make sure worker node upgrade properly - Orabug 27649898 1.9.1-2.1.3.dev - Ensure that the runtime mounts RO volumes read-only CVE-2017-1002102 - Update Dashboard version...

PT-2018-1306 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 18.0 Description: A Server-Side Request Forgery SSRF issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to th...

PT-2018-1905 · Rsync +3 · Rsync +3

Name of the Vulnerable Software and Affected Versions: rsync versions prior to 3.1.3 Description: The issue is related to the parse arguments function in options.c in rsyncd, which does not prevent multiple uses of the --protect-args parameter. This allows remote attackers to bypass an...

Server-side Request Forgery (SSRF)

Overview github.com/goharbor/harbor/src/core/api is a cloud native registry project that stores, signs, and scans content. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Mozilla Firefox Security Advisories (MFSA2017-05, MFSA2017-07) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Apache Brooklyn vulnerable to cross-site scripting

Overview Apache Brooklyn is a framework for modeling, monitoring, and managing applications. Apache Brooklyn contains cross-site scripting vulnerabilities. It is known that proof-of-concept code to exploit these vulnerabilties exist. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc...

RedHat Update for thunderbird RHSA-2016:2825-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2016-4587 · Openssl · Rust-Openssl

Name of the Vulnerable Software and Affected Versions: rust-openssl versions prior to 0.9.0 Description: The issue is related to SSL/TLS man-in-the-middle attacks due to insecure defaults in the openssl crate for Rust. Specifically, certificate verification is off by default, and there is no API...

SOL01471335 - BIND vulnerability CVE-2016-2848

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

PT-2016-6216 · Red Hat +4 · Libvirt +5

Name of the Vulnerable Software and Affected Versions: libvirt versions prior to 2.0.0 Description: The issue allows remote attackers to bypass authentication and establish a VNC session by connecting to the server when the password on a VNC server is set to an empty string. Recommendations: For...

PT-2016-3293

Name of the Vulnerable Software and Affected Versions bzip2 versions 1.0.6 and earlier Description The issue is related to an out-of-bounds write in the BZ2 decompress function in decompress.c when there are many selectors. This can lead to memory corruption, resulting in a denial of service and/...

SOL61200338 - NTP vulnerability CVE-2016-2517

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL20804323 - NTP vulnerability CVE-2016-2518

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL33209124 - OpenSSL vulnerability CVE-2015-3197

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Cross-site Scripting (XSS)

Overview angularjs is a Affected versions of this package are vulnerable to Cross-site Scripting XSS. due to the usemap attribute not being blacklisted. Remediation Upgrade angularjs to version 1.5.0 or higher. References - GitHub ChangeLog - GitHub Commit - GitHub PR Credit: Lucas Mirelmann...

SOL08039035 - MySQL vulnerability CVE-2015-4910

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL17515 - NTP vulnerability CVE-2015-7855

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL17494 - PAM vulnerability CVE-2015-3238

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

PT-2015-4561 · 389 Directory Server +2 · Slapi-Nis Plug-In +2

Name of the Vulnerable Software and Affected Versions: slapi-nis plug-in versions prior to 0.54.2 Description: The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and CPU consumption. This can be achieved by requesting a group with a large number of membe...