Important Photon OS Security Update - PHSA-2021-0358

Updates of 'sudo', 'pkg-config' packages of Photon OS have been released...

Exploit for Code Injection in Microsoft

somepocsuite 用于企业内部进行漏洞排查与验证的的pocsuite3验证POC代码（pocsuite3是知道创宇安全团队的开源漏洞测试框架）。 由于原Pocsuite已停止更新，因此将原来的POC代码全部重新改写并迁移到pocsuite3，原POC备份在PocsuiteV2中。 插件代码编写 使用pocsuite3 漏洞测试框架，插件编写请参考 pocsuite3 项目插件编写要求。 PoC 编写规范及要求说明 | 序号 | poc | 说明 | | ---- | --------------------------------------- |...

Metasploit Wrap-Up

SaltStack RCE wvu-r7 added an exploit module that targets SaltStack’s Salt software. Specifically, the module exploits both an authentication bypass CVE-2020-25592 and a command injection vulnerability CVE-2020-16846 in SaltStack’s REST API to get code execution as root through Salt’s SSH client ...

Apache ZooKeeper Information Disclosure

Apache ZooKeeper server service runs on TCP 2181 and by default, it is accessible without any authentication. This module targets Apache ZooKeeper service instances to extract information about the system environment, and service statistics. Module Options msf use...

Security Bulletin: Apache ZooKeeper as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2019-0201)

Summary Apache ZooKeeper as used by IBM QRadar SIEM is vulnerable to information disclosure. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permissions by the getACL command. By...

Security Bulletin: A Zookeeper Remote DoS vulnerability affects IBM BigInsights (CVE-2017-1213 )

Summary A security vulnerability has been identified in Open Source Zookeeper that affects IBM BigInsights IBM Open Platform with Apache Hadoop. Vulnerability Details CVEID: CVE-2017-1213 DESCRIPTION: IBM BigInsights Zookeeper when accessed behind a firewall where Jetty AdminServer is not...

The implementation of the getACL() command in the centralized service for managing configuration information, naming, distributed synchronization, and providing group services in Apache ZooKeeper is vulnerable. This vulnerability allows attackers to exploit certain hash function values.

The vulnerability of the getACL function in the centralized service for managing configuration information, naming, distributed synchronization, and providing group services in Apache ZooKeeper is related to permission handling errors. Exploiting this vulnerability can allow an attacker to exploi...

Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product

Summary DB2 contains several vulnerabilities which can affect the IBM Performance Management product. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins. Vulnerability Details CVEID: CVE-2017-12973 DESCRIPTION: Connect2id Nimbus JOSE+JWT...

SUSE-SU-2020:1066-1 Security update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper

This update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp...

Security Bulletin: IBM Agile Lifecycle Manager is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)

Summary IBM Agile Lifecycle Manager 2.1 has addressed the following vulnerability in Apache ZooKeeper. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permissions by the getACL...

CVE-2019-15024

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When...

CVE-2019-15024

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When...

Design/Logic Flaw

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When...

CVE-2019-15024

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When...

Security Bulletin: Netcool Operations Insight - Cloud Native Event Analytics is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)

Summary Netcool Operations Insight - Cloud Native Event Analytics has addressed the following vulnerability in Apache ZooKeeper. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL comman...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-4244)

Summary IBM Operations Analytics - Log Analysis has addressed the following vulnerability in Apache ZooKeeper. CVEs: CVE-2019-4244 Vulnerability Details CVEID: CVE-2019-4244 DESCRIPTION: CVSS Base score: 9.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159518 for...

zookeeper: Information disclosure in Apache ZooKeeper

A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R14 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability in the web interface of the Exhibitor service for managing ZooKeeper instances allows a attacker to execute arbitrary commands.

The vulnerability of the Exhibitor web interface for managing ZooKeeper instances exists due to the failure to eliminate special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with privileges...

CVE-2019-4244

IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518...