CVE-2021-3020

An issue was discovered in ClusterLabs Hawk aka HA Web Konsole through 2.3.0-15. It ships the binary hawkinvoke built from tools/hawkinvoke.c, intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root with an attempt to limit this to safe...

CVE-2021-3020

An issue was discovered in ClusterLabs Hawk aka HA Web Konsole through 2.3.0-15. It ships the binary hawkinvoke built from tools/hawkinvoke.c, intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root with an attempt to limit this to safe...

Design/Logic Flaw

An issue was discovered in ClusterLabs Hawk aka HA Web Konsole through 2.3.0-15. It ships the binary hawkinvoke built from tools/hawkinvoke.c, intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root with an attempt to limit this to safe...

CVE-2021-3020

CVE-2021-3020 (ClusterLabs Hawk / HA Web Konsole) describes a privilege-escalation in Hawk up to version 2.3.0-15 where the setuid binary hawk_invoke can be used by hacluster to run commands as root, potentially spawning an interactive shell outside the allowed set. This leads to root elevation i...

CVE-2021-3020

An issue was discovered in ClusterLabs Hawk aka HA Web Konsole through 2.3.0-15. It ships the binary hawkinvoke built from tools/hawkinvoke.c, intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root with an attempt to limit this to safe...

CVE-2021-3020

Removed by vendor...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...

MAL-2022-4886 Malicious code in node-hawk-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b6cacaf97cef11a805b76e90dd4702701b8e0e4ef3a56e6a5ffaa61745fb46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Emerson DeltaV Distributed Control System 访问控制错误漏洞

Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson. The system includes features such as network security management, alarm management, batch control, and change management. An access control error vulnerability exists in the Emerson DeltaV Distribut...

PT-2022-3156 · Emerson · Emerson Deltav Distributed Control System

Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS through 2022-04-29 Description: The issue is related to weaknesses in the authentication procedure of the Emerson DeltaV Distributed Control System DCS. This allows a remote attacker to access...

00ld8nuivn (=2.1.0), 00rqiw31nd (=2.1.0) +29954 more potentially affected by CVE-2022-29167 via hawk (>=0.0.8 <=9.0.0)

hawk NPM version =0.0.8, =1.0.1, =1.0.4 - 02vx8qsp01 =2.1.0 - 05y6tjgmws =1.1.0 - 06-tekbooks =0.1.0 - 066m7q8o0z =2.1.0 - 06buj9h3su =2.1.0 - 06dre15t8r =2.1.0 - 07fgapmu9l =1.1.0 - 07t2xvu6t4 =2.1.0 - 0850u4lkpu =1.1.0 - 098of6vzvl =1.1.0 and more Source cves: CVE-2022-29167 Source advisory:...

GHSA-44PW-H2CW-W3VQ Uncontrolled Resource Consumption in Hawk

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP...

Uncontrolled Resource Consumption in Hawk

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP...

OESA-2022-1667 nodejs-hawk security update

Hawk is an HTTP authentication scheme using a message authentication code MAC algorithm to provide partial HTTP request cryptographic verification. Security Fixes: Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic...

Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

GHSA-QC2P-Q7X9-V64P Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Regular Expression Denial Of Service (ReDoS)

hawk is vulnerable to regular expression denial of service ReDoS attacks. An attacker is able to increase the computational time exponentially by adding a huge number of characters through Hawk.utils.parseHost function to slowdown and cause denial of service conditions in the application...

CVE-2022-29167

A regular expression denial of service ReDoS was found in Hawk in its header parsing functionality. The issue arises from inadequate input validation in the Hawk.utils.parseHost function when processing untrusted input with regular expressions. This flaw allows an attacker to send a specially...