Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.16 extras security update

Red Hat OpenShift Container Platform release 4.6.16 is now available with updates to packages and images that fix several bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Kubernetes: API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint

Report Submission Form Summary: I was trying to explore a way to stealthily send lots of data outside a private GKE cluster by way of misusing the Validating Webhook mechanism. The idea would be that a cluster-admin could install a webhook and then initiate resources like a secret or configmap th...

CVE-2021-22132

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

[SECURITY] [DSA 4841-1] slurm-llnl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4841-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2021 https://www.debian.org/security/faq -...

openSUSE Security Update : openssh (openSUSE-2020-2298)

This update for openssh fixes the following issues : - CVE-2020-14145: Fixed a potential information leak during host key exchange bsc1173513. - Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install bsc1142000 - Fixed an issue where oracle cluster with cluvfy using...

Man-in-the-Middle (MitM)

github.com/kubernetes/kubernetes is vulnerable to man-in-the-middle attacks. An attacker is able to intercept and modify traffic other pods or nodes in the cluster if there is permission to create or edit services and pods...

CDK - Zero Dependency Container Penetration Toolkit

CDK is an open-sourced container penetration toolkit, designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs helps you to escape container and takeover K8s cluster easily. Currently still unde...

CVE-2020-26278

Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is...

Weaveworks Weave Net Security Breach

Weaveworks Weave Net is a cloud-native networking toolkit from Weaveworks UK. Weave Net suffers from a security vulnerability that can be exploited by an attacker to take over any host in a cluster...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25324

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp...

Design/Logic Flaw

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25324

CVE-2021-25324 affects MISP 2.4.136 with a Stored XSS flaw in the galaxy cluster view (app/View/GalaxyClusters/view.ctp). Root cause details are not fully disclosed in the provided documents, but the vulnerability is described by multiple sources as a cross-site scripting issue that could impact ...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25325

CVE-2021-25325 affects MISP 2.4.136. It enables cross-site scripting via galaxy cluster element values sent to app/View/GalaxyElements/ajax/index.ctp, where reference types may include javascript: URLs. The issue arises from unsanitized input in galaxy elements, enabling an attacker to execute sc...

IBM Spectrum LSF 10.1 / 10.2 Hardcoded Eauth Key / Eauth Key Exposure Vulnerability

================================================================================ Multiple IBM Spectrum LSF Authentication Vulnerabilities Eauth - CVE-2020-4983 ================================================================================ Software: Spectrum LSF Vendor: IBM Affected Versions:...

IBM Spectrum LSF 命令注入漏洞

IBM Spectrum LSF Suite is a workload management solution from IBM USA. A security vulnerability exists in IBM Spectrum LSF that can be exploited by an attacker to gain root access to the cluster...

Information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

Security Bulletin: Vulnerability in Apache Solr affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary There is a missing authorization vulnerability in the Apache Solr service that is distributed as part of Watson Knowledge Catalog for IBM Cloud Pak for Data. The issue is now addressed. Vulnerability Details CVEID: CVE-2020-13957 DESCRIPTION: Apache Solr could allow a remote attacker to...