CVE-2018-17196

CVE-2018-17196 (Apache Kafka) : A vulnerability in Kafka versions 0.11.0.0–2.1.0 allows a remote authenticated attacker to bypass transaction/idempotent ACL validation by crafting a Produce request. The issue stems from improper input validation, requiring authenticated clients with Write permiss...

CVE-2018-17196

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to...

Apache axis remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, convinced that the server found the Apache axis component remote command execution exploit way. The vulnerability is essentially due to the administrator for the AdminService configuration error, when enableRemoteAdmin property is set to true, the attacker can remotely use of the...

HackerOne: Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled

The Custom Field feature is currently only available for customers on the Enterprise product edition. A trial period can be given by enabling the custom-fields-trial feature for programs who are not on that product edition yet. However, when enabling this feature, the incorrect ordering of an ACL...

CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

DEBIAN-CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

UBUNTU-CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

Out-of-bounds

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name obtained from bridge.conf or a --br=bridge option is limited to the IFNAMSIZ size, which can lead to an ACL bypass...

CVE-2019-13164

CVE-2019-13164 affects QEMU via qemu-bridge-helper.c. The issue arises in QEMU 3.1 and 4.0.0 where a network interface name obtained from bridge.conf or a --br=bridge option is not constrained to the IFNAMSIZ size, enabling an ACL bypass. Connected sources corroborate that this ACL bypass vulnera...

SUSE-SU-2019:1574-2 Security update for samba

This update for samba fixes the following issues: Security issues fixed: - CVE-2019-12435: zone operations can crash rpc server; bso13922; bsc1137815. Other issues fixed: - Fix cephwrapflistxattr debug message; bso13940; bsc1134697. - Add cephsnapshots VFS module; jscSES-183. - Fix vfsceph...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:1574-1)

"This update for samba fixes the following issues : Security issues fixed : CVE-2019-12435: zone operations can crash rpc server; bso13922 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SUSE update advisory SUSE-SU-2019:1574-1. The text...

SUSE-SU-2019:1574-1 Security update for samba

This update for samba fixes the following issues: Security issues fixed: - CVE-2019-12435: zone operations can crash rpc server; bso13922; bsc1137815. Other issues fixed: - Fix cephwrapflistxattr debug message; bso13940; bsc1134697. - Add cephsnapshots VFS module; jscSES-183. - Fix vfsceph...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

Design/Logic Flaw

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

CVE-2018-6185 concerns Cloudera Navigator Key Trustee KMS (versions 5.12 and 5.13). The root cause is an incorrect default ACL configuration for the two additional APIs (PURGE and UNDELETE) that govern encryption-zone keys; the ACLs default to “*”, permitting remote access to these commands. This...