CVE-2017-9795

CVE-2017-9795 affects Apache Geode clusters running in secure mode prior to v1.3.0. A user with read access to specific regions can execute OQL queries that read/write objects in unauthorized regions and may invoke methods enabling remote code execution. The documents do not specify exploit vecto...

CVE-2017-12622

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges...

CVE-2017-12622

Summary: Apache Geode gfsh authorization vuln allows an authenticated user to read status information and control cluster members via HTTP in clusters running a Geode version before 1.3.0, even without CLUSTER:MANAGE privileges. Affected product/version: Apache Geode; versions before 1.3.0. Impac...

CVE-2017-9796

CVE-2017-9796 affects Apache Geode prior to v1.3.0 when operating in secure mode. A user with read access to certain regions can have their OQL query bind parameter specify a region name, which may grant read access to objects in unauthorized regions. This is documented in multiple sources (GitHu...

OPENSUSE-SU-2017:3451-1 Security update for phpMyAdmin

This update for phpMyAdmin to version 4.7.7 fixes a security issue and bugs. The following vulnerability was fixed: - By deceiving a user to click on a crafted URL, it was possible to perform harmful database operations bsc1074066, PMASA-2017-09 This update also contains all upstream improvements...

Low: Red Hat Security Advisory: org.ovirt.engine-root security, bug fix, and enhancement update

An update for org.ovirt.engine-root is now available for Red Hat Virtualization Manager version 4.1. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2017-3926 · Mariadb +2 · Mariadb +3

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.1.30 MariaDB versions 10.2.x prior to 10.2.10 Percona XtraDB Cluster versions prior to 5.6.37-26.21-3 Percona XtraDB Cluster versions 5.7.x prior to 5.7.19-29.22-3 Description: The issue is related to incorrect...

[SECURITY] Fedora 27 Update: slurm-17.02.9-3.fc27

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for large and small Linux clusters...

The vulnerability of the clusterLoadConfig function in the Redis database management system allows a attacker to cause service interruptions or other adverse effects.

The vulnerability of the clusterLoadConfig function in the Redis database management system arises from an operation that occurs outside the buffer in memory, due to the lack of checks on the values of migratingslotsto and migratingslotsfrom, which are defined in the configuration file. Exploitin...

CVE-2017-15535

A memory corruption flaw was found in the way MongoDB handled wire protocol compression for intra-cluster communication. A privileged network attacker could potentially use this flaw to crash the MongoDB server under certain circumstances...

[SECURITY] Fedora 27 Update: slurm-17.02.9-2.fc27

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for large and small Linux clusters...

CVE-2017-5201

NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allow remote authenticated users to obtain sensitive cluster and tenant information via unspecified vectors, a different vulnerability than CVE-2016-3064...

NetApp Clustered Data ONTAP Information Disclosure Vulnerability (CNVD-2017-36367)

NetApp Clustered Data ONTAP is a set of storage operating system for clustered mode from American NetApp. The system supports users to enhance the performance of enterprise applications and improve data center flexibility and so on. A security vulnerability exists in NetApp Clustered Data ONTAP...

PT-2017-3927 · Postgresql +1 · Postgresql-Common +1

Name of the Vulnerable Software and Affected Versions: postgresql-common versions prior to 181+deb9u1 Description: The issue is related to the incorrect handling of symbolic links by the pg ctlcluster, pg createcluster, and pg upgradecluster scripts in the postgresql-common package for PostgreSQL...

Debian DSA-4023-1 : slurm-llnl - security update

Ryan Day discovered that the Simple Linux Utility for Resource Management SLURM, a cluster resource management and job scheduling system, does not properly handle SPANK environment variables, allowing a user permitted to submit jobs to execute code as root during the Prolog or Epilog. All systems...

[SECURITY] [DSA 4023-1] slurm-llnl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4023-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 07, 2017 https://www.debian.org/security/faq -...

Distributed File Analysis Framework: Assemblyline

Assemblyline is a scalable distributed file analysis framework . It is designed to process millions of files per day but can also be installed on a single box. Canada’s electronic spy agency says it is taking the “unprecedented step” of releasing one of its own cyber defence tools to the public, ...

CVE-2017-15945

The CVE-2017-15945 issue affects Gentoo package installation scripts for dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera prior to 2017-09-29. The root cause is misused chown calls on user-writable directory trees, enabling a local user with acc...

Cross-site Request Forgery (CSRF)

Hadoop YARN is vulnerable to cross-site request forgery CSRF attacks. The application does not have any CSRF protection, allowing an attacker to send requests to the Hadoop cluster...

USN-3462-1: Pacemaker vulnerabilities

Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue to execute arbitrary code with root privileges. CVE-2016-7035 Alain Moulle discovered that Pacemaker incorrectly handled authentication. A remote attacker...