Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw...

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs...

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p "; this operation does not fail if...

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs...

githubFind3r - Fast Command Line Repo/User/Commit Search Tool

githubFind3r is a very fast command line repo/user/commit search tool Installation git clone https://github.com/atmoner/githubFind3r.git cd githubFind3r npm install Run it node githubFind3r.js Download githubFind3r...

Scientific Linux Security Update : libosinfo on SL7.x x86_64 (20200407)

Libosinfo: osinfo-install-script option leaks password via command line argument C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135815; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Receiver 4.4 Selfservice.exe -terminate Does Not Disconnect Sessions

Citrix receiver 4.4. Selfservice.exe -terminate. When running this command line there is no response of the command other commands appear to work as expected. CTX200337 -Driving the Citrix Receiver Self-Service Plug-in Programmatically...

ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under...

Description of the security update for the Microsoft Visual Studio 2005 Service Pack 1 development platform

Description of the security update for the Microsoft Visual Studio 2005 Service Pack 1 development platform INTRODUCTION Microsoft has released security bulletin MS07-052. The security bulletin contains all the relevant information about the security update. This information includes file manifes...

Description of the security update for Microsoft Visual Studio 2008: July 28, 2009

Description of the security update for Microsoft Visual Studio 2008: July 28, 2009 INTRODUCTION Microsoft has released security bulletin MS09-035. To view the complete security bulletin, visit one of the following Microsoft Web sites: Home...

CVE-2020-6765

D-Link DSL-GS225 J1 AU1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as demonstrated by ping -c1 127.0.0.1; cat/etc/passwd. The CLI is reachable by TELNET...

Privilege Escalation

qemu-kvm is vulnerable to privilege escalation. It was found that qemu-kvm did not properly drop supplemental group privileges when the root user started guests from the command line "/usr/libexec/qemu-kvm" with the "-runas" option. A qemu-kvm process started this way could use this flaw to gain...

Information Disclosure

encryptfs-utils is vulnerable to information disclosure. A disclosure flaw was found in the way the "ecryptfs-setup-private" script passed passphrases to the "ecryptfs-wrap-passphrase" and "ecryptfs-add-passphrase" commands as command line arguments. A local user could obtain the passphrases of...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists as a flaw was found in the way Firefox handled certain command line URLs. If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges...

CentOS 7 : libosinfo (RHSA-2020:1051)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1051 advisory. - libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line...

Improvements for the System Update Readiness Tool in Windows 7 and Windows Server 2008 R2

Improvements for the System Update Readiness Tool in Windows 7 and Windows Server 2008 R2 About the System Update Readiness Tool The System Update Readiness Tool can help fix problems that might prevent Windows updates and service packs from installing. For more information and how to download th...

CVE-2018-1002101

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection...

The vulnerability of the command-line interface of the Cisco FXOS operating system allows a attacker to gain access to read, modify, add, or delete data.

The vulnerability of the command-line interface of the Cisco FXOS operating system is related to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

The vulnerability of the command-line interface of the Cisco Unified Computing System (UCS) Manager and the Cisco FXOS operating system allows a hacker to execute arbitrary code.

The vulnerability of the command-line interface of the Cisco Unified Computing System UCS Manager and the Cisco FXOS operating system is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow an attacker to...

The vulnerability of the command-line interface of the Cisco FXOS operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the Cisco FXOS operating system’s command-line interface relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...