GHSA-PHMW-JX86-X666 Authenticated Rundeck users can view or delete jobs they do not have authorization for.

Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. The affected URLs are: - https://host/context/rdJob/ -...

PT-2023-30317 · Rundeck · Rundeck

Name of the Vulnerable Software and Affected Versions: Rundeck versions prior to 4.17.3 Description: The issue allows authenticated users to access certain URL paths without necessary authorization checks, providing a list of job names and groups for any project. The affected URLs are...

CVE-2023-47107

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users...

Design/Logic Flaw

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users...

CVE-2023-47107

Summary of mode C (concrete details): PILOS, the BigBlueButton front-end, has a vulnerability in its password reset flow where the reset URL is built using the request host header. An attacker could lure affected users to a URL that points to the attacker’s server, potentially disclosing the pass...

CVE-2023-47107 PILOS account takeover through password reset poisoning

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users...

Moderate: Red Hat Security Advisory: haproxy security and bug fix update

An update for haproxy is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: haproxy security and bug fix update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: data leak via fcgi requests CVE-2023-0836 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other relate...

ALSA-2023:6496 Moderate: haproxy security and bug fix update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: data leak via fcgi requests CVE-2023-0836 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other relate...

Kubernetes man in the middle using LoadBalancer or ExternalIPs

...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 2 (5.4.4-132)

This update provides important stability, security, and performance improvements. Vulnerability id: VSTOR-75357 Fixed a critical security vulnerability. Vulnerability id: VSTOR-76306 Fixed a problem that may occur while closing files with erasure coding. Vulnerability id: VSTOR-76257 Add the...

PT-2023-12075

Name of the Vulnerable Software and Affected Versions Kube-proxy versions affected versions not specified Description The issue concerns Kube-proxy on Windows, which can unintentionally forward traffic to local processes listening on the same port spec.ports.port as a LoadBalancer Service. This...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, prometheus-statsd-exporter-fips, slsa-verifier, tekton-chains, kubewatch, kubernetes-dashboard-metrics-scraper, aws-ebs-csi-driver, prometheus-mysqld-exporter, crossplane-provider-aws, cosign, nodetaint, mc, prometheus-statsd-exporte...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, prometheus-statsd-exporter-fips, slsa-verifier, tekton-chains, kubewatch, kubernetes-dashboard-metrics-scraper, aws-ebs-csi-driver, prometheus-mysqld-exporter, crossplane-provider-aws, cosign, nodetaint, mc, prometheus-statsd-exporte...

F5 BIG-IP 路径遍历漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management and other functions. A directory traversal vulnerability exists in the F5 BIG-IP configuration utility, which can be exploited by a...

Amazon Linux 2 : nginx (ALASNGINX1-2023-004)

The version of nginx installed on the remote host is prior to 1.18.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-004 advisory. NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an...

How to check the port connectivity between NetScaler and VDA server

This article describes how to check port connectivity between NetScaler SNIP and VDA over TCP 2598 or 1494 by LB service...

How to create a TLS1.3 profile on NetScaler

This is a step-by-step on how to create a profile TLS 1.3 on the NetScaler and attach those to specific LB Virtual Server...

Citrix ADC 和 Citrix Gateway 安全漏洞

Citrix Systems Citrix Gateway Citrix Systems NetScaler Gateway and Citrix ADC are both products of Citrix Systems, Inc.Citrix Gateway is a secure remote access solution. The product provides administrators with application-level and data-level controls to enable users to remotely access...

GHSA-3FQM-FRHG-7C85 Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...