248 matches found
Cybercriminals Are Using Legit Cloud Monitoring Tools As Backdoor
A cybercrime group that has previously struck Docker and Kubernetes cloud environments has evolved to repurpose genuine cloud monitoring tools as a backdoor to carry out malicious attacks, according to new research. "To our knowledge, this is the first time attackers have been caught using...
Cybercriminals Are Using Legit Cloud Monitoring Tools As Backdoor
A cybercrime group that has previously struck Docker and Kubernetes cloud environments has evolved to repurpose genuine cloud monitoring tools as a backdoor to carry out malicious attacks, according to new research. "To our knowledge, this is the first time attackers have been caught using...
PT-2020-21815
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves functions such as ideint weave blk, ideint process, and impeg2d deinterlace...
PT-2020-21723
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves functions such as ideint weave blk, ideint process, and impeg2d deinterlace...
PT-2020-11549
Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description The issue is related to a heap buffer overflow in the ideint weave blk function of ideint utils.c, which could lead to remote code execution without requiring additional execution privileges. User...
Man-in-the-Middle (MtiM)
github.com/weaveworks/weave is vulnerable to Man-in-the-Middle MtiM. IPv4 only clusters allows for MitM attacks via IPv6 rogue router advertisements if an attacker is able to run a process as root in a container and is able to respond to DNS requests from the host...
Unspecified Vulnerability in Weaveworks Weave Net
Weaveworks Weave Net is a cloud-native networking toolkit from Weaveworks UK. A security vulnerability in Weaveworks Weave Net versions prior to 2.6.3 can be exploited by an attacker to reconfigure a host to redirect some or all of the host's IPv6 traffic to a container under the attacker's contr...
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
Command injection
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2020-11091 Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2020-11091
CVE-2020-11091 affects Weave Net up to version 2.6.3. An attacker that can run a root process in a container can respond to DNS requests from the host and insert themselves as a fake service. In IPv4 internal networks, if IPv6 is not fully disabled and IPv6 forwarding is off but accept_ra is on, ...
PT-2020-12547 · Weave · Weave Net
Name of the Vulnerable Software and Affected Versions: Weave Net versions prior to 2.6.3 Description: An attacker able to run a process as root in a container can respond to DNS requests from the host and insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is...
CVE-2020-11091: Reliance on Reverse DNS Resolution for a Security-Critical Action
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
Unauthorized access vulnerability in Weave Scope (CNVD-2020-01342)
Weave Scope is a Docker and Kubernetes visualization and monitoring tool that provides a complete view of cluster infrastructure and applications from top to bottom, making it easy to monitor and diagnose problems with distributed containerized applications in real-time. An unauthorized access...
DEBIAN-CVE-2019-18798
LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...