Security Bulletin: App Connect Enterprise Certified Container is vulnerable to CVE-2019-11324

Summary The App Connect Enterprise Certified Container Dashboard is vulnerable to CVE-2019-11324 through its use of CouchDB for storing flow data, where the Operator is installed in a Restricted Network cluster. Vulnerability Details CVEID: CVE-2019-11324 DESCRIPTION: urllib3 could allow a remote...

CVE-2020-25827

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster such as via CentralAuth, rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across...

Code injection

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster such as via CentralAuth, rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across...

CVE-2020-25827

MediaWiki CVE-2020-25827 affects the OATHAuth extension. The issue occurs when Wikis run OATHAuth on a farm/cluster (e.g., CentralAuth) where token rate limiting is enforced only at a single site level; this enables issuing multiple OATH token requests across many wikis/sites concurrently. Affect...

PT-2020-6813 · Oathauth +3 · Oathauth +3

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.31.10 MediaWiki versions 1.32.x through 1.34.x before 1.34.4 Description: The issue is related to insufficient restriction of authentication attempts in the OATHAuth extension for MediaWiki. This can be exploited...

CVE-2020-14306

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged...

CVE-2020-5420 Gorouter is vulnerable to DoS attack via invalid HTTP responses

Cloud Foundry Routing Gorouter versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters...

CVE-2020-5420

Cloud Foundry Routing Gorouter versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters...

Exporting Nginx Access Logs to an ELK Cluster

The Wallarm WAF provides an organization with the ability to protect their applications and APIs against a wide range of attacks. However, an organization may wish to achieve a greater degree of visibility into attack traffic and alerts than is possible via the Wallarm user interface. The Wallarm...

Cisco HyperFlex Software Unauthenticated Root Access (cisco-sa-20190220-chn-root-access)

According to its self-reported version, Cisco HyperFlex HX-Series is affected by a vulnerability in the hxterm service due to insufficient authentication controls. An unauthenticated, local attacker can exploit this, by connecting to the hxterm service as a non-privileged, local user, in order to...

August 11, 2020—KB4571723 (Security-only update)

None None...

August 11, 2020—KB4571702 (Security-only update)

None None...

August 11, 2020—KB4571730 (Monthly Rollup)

None None...

PXC Release update for April 2020 MySQL security patches | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Description Cloud Foundry Deployment, through its consumption of Percona XtraDB Cluster Release, is vulnerable to various MySQL vulnerabilities patched in the April 2020 Critical Patch Update, including the following high and critical issues:...

CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...

CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.31 bug fix update

Red Hat OpenShift Container Platform release 4.3.31 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

Vulnerability of the Cluster component: Packaging (dojo) of the Oracle MySQL Cluster database management system, which allows attackers to compromise data integrity.

The vulnerability of the Cluster: Packaging dojo component of the Oracle MySQL Cluster database management system exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the integrity ...

elasticsearch: Information exposure via _cluster/settings API

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This...

Permission Manager - A Project That Brings Sanity To Kubernetes RBAC And Users Management, Web UI FTW

Welcome to the Permission Manager! Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBACmanagement for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this is the right place. Wit...