Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1

Summary This SB contains a list for all CVE's listed here - CVE-2022-36083, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2021-21797, CVE-2022-35941, CVE-2021-42248, CVE-2021-42836, CVE-2022-40186, CVE-2022-41316, CVE-2021-36090, CVE-2020-29529, CVE-2020-7219 fixed in 3.5.1 Vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2024-10005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in Consul and Consul Enterprise Consul such that using URL paths in L7 traffic intentions could bypass HTTP request path-based...

Linux Distros Unpatched Vulnerability : CVE-2021-41803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim...

Linux Distros Unpatched Vulnerability : CVE-2022-24687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to...

Linux Distros Unpatched Vulnerability : CVE-2021-32574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject...

Linux Distros Unpatched Vulnerability : CVE-2024-10006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in Consul and Consul Enterprise Consul such that using Headers in L7 traffic intentions could bypass HTTP header based access...

Linux Distros Unpatched Vulnerability : CVE-2022-40716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling...

Linux Distros Unpatched Vulnerability : CVE-2021-37219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only...

Linux Distros Unpatched Vulnerability : CVE-2022-29153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: ctop, flux, vcluster, logstash-exporter, docker-compose, oras, git-lfs, caddy, gitsign, doppler-kubernetes-operator, postgres-operator, syft, newrelic-fluent-bit-output, nri-kubernetes, spicedb, shfmt, flux-image-reflector-controller, tfsec, nri-prometheus,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: runc, ctop, nri-apache, kwok, buildkitd, direnv, flux, nri-elasticsearch, sonobuoy, go-bindata, logstash-exporter, s5cmd, hello-world-golang, prometheus-pushgateway, pulumi-language-yaml, oras, cluster-proportional-autoscaler, kor, gcsfuse, caddy, nri-mssql,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: render-template, kubernetes-event-exporter, kind, dex-k8s-authenticator, nri-mssql, rqlite, controller-gen, flux-image-reflector-controller, smarter-device-manager-fips, kubernetes-dashboard-fips, kaf, influx, task, up, prometheus-statsd-exporter-fips,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: render-template, kubernetes-event-exporter, kind, dex-k8s-authenticator, nri-mssql, rqlite, controller-gen, flux-image-reflector-controller, smarter-device-manager-fips, kubernetes-dashboard-fips, kaf, influx, task, up, prometheus-statsd-exporter-fips,...

Exploit for Incorrect Authorization in Hashicorp Consul

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING...

GLSA-202412-14 : HashiCorp Consul: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-14 HashiCorp Consul: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding descriptio...

HashiCorp Consul: Multiple Vulnerabilities

Background HashiCorp Consul is a tool for service discovery, monitoring and configuration. Description Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

The vulnerability of the Consul service configuration tool lies in the incorrect limitation of the path name to the restricted catalog, allowing attackers to circumvent security restrictions.

The vulnerability of the Consul service configuration tool is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTTP request...

The vulnerability of the Consul service configuration tool arises from the lack of measures taken to protect the structure of web pages. This allows attackers to carry out XSS attacks.

The vulnerability of the Consul service configuration tool exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

ROS-20241121-06

A vulnerability in the Consul service configuration tool is related to the use of URL paths in L7 traffic. Exploitation of the vulnerability could allow an attacker acting remotely to bypass access rules based on HTTP request paths. HTTP request paths The vulnerability in the Consul service...

GoCast NAT parameter OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-1961 GoCast NAT parameter OS command injection vulnerability November 21, 2024 CVE Number CVE-2024-29224 SUMMARY An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command...