2848 matches found
openstack-nova: Soft reboot after live-migration reverts instance to original source domain XML
An information disclosure flaw was found in the live migration feature of OpenStack Nova. A user may gain access to destination host devices with the same path as those on the source host. This flaw allows an attacker to perform a soft reboot of an instance that has previously undergone live...
RHEL 7 : openstack-nova (RHSA-2020:3708)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3708 advisory. OpenStack Compute nova launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute...
CVE-2020-2043
An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple tim...
TeamTNT Gains Full Remote Takeover of Cloud Instances
The TeamTNT cybercrime gang is back, attacking Docker and Kubernetes cloud instances by abusing a legitimate cloud-monitoring tool called Weave Scope, according to researchers. The open-source Weave Scope “provides a top down view into your app as well as your entire infrastructure, and allows yo...
cloud-init: default configuration disabled deletion of SSH host keys
The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct...
GitLab: Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances
NOTE: I am still researching whether there is a possibility to deploy the exploit without user interaction. Summary GitLab provides a rich representation for Jupyter Notebooks .ipynb. In turn, Jupyter Notebooks provide the possibility for rich output via HTML. Although most tags and attributes ar...
The default cloud-init configuration in cloud-init 0.6.2 and newer included "ssh_deletekeys: 0" disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances created by cloning a golden master or template system sharing ssh host keys and being able to impersonate one another or conduct man-in-the-middle attacks.
...
Deploy Jenkins Serverless-ly in Azure Services
Get a how-to guide on deploying Jenkins serverless-ly and securely utilizing Microsoft® Azure®-hosted services with Azure Container Instances, Azure Files, and Azure Bastion...
kernel: use-after-free in sound/core/timer.c
A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...
CVE-2020-14316
A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...
PT-2020-13972
Name of the Vulnerable Software and Affected Versions kubevirt versions 0.29 and earlier Description A flaw in kubevirt allows Virtual Machine Instances VMIs to be used to gain access to the host's filesystem. Successful exploitation enables an attacker to assume the privileges of the VM process ...
cloud-init: default configuration disabled deletion of SSH host keys
The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct...
kernel: use-after-free in sound/core/timer.c
A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...
kernel: use-after-free in sound/core/timer.c
A memory flaw was found in the ALSA subsystem of the Linux kernel. The struct sndtimerinstance function fails the timer-maxinstances check leading to an invalid address. This could lead to a use-after-free vulnerability...
Important Announcement
ATTENTION: Your vulnerability tests are out of maintenance and not updated since July 1st 2020. Your setup of Greenbone Source Edition will not report about any new threats in your scanned environment since this date! REASON: Your Greenbone setup is connected to a discontinued download protocol o...
PT-2020-14378 · Zyxel · Zyxel Cloudcnm Secumanager
Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get instances for update" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting...
Moderate: Red Hat Security Advisory: openstack-manila and openstack-manila security update
An update for openstack-manila and openstack-manila is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Secure Apps / SecureWeb Supportability with WkWebview framework
WkWebView is not supported in the following scenarios: Devices running iOS 10 or earlier. Setups configured for Full VPN Mode. Setups running Endpoint Management integration with EMS/Intune. Apps that use two instances of the WKWebView component simultaneously. If you are already using the Full V...
MongoDB Ops Manager Information Disclosure Vulnerability
MongoDB Ops Manager is a MongoDB USA solution that supports managing, monitoring and backing up MongoDB deployments. A security vulnerability exists in MongoDB Ops Manager versions 4.0.9, 4.0.10, and 4.1.5. An attacker could exploit the vulnerability to view specific access logs for publicly...
