128 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in the API in Ubuntu Metal as a Service MaaS 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/...
Authentication flaw
Ubuntu Metal as a Service MaaS 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file...
CVE-2013-1069
CVE-2013-1069 is a cross-site scripting vulnerability in Ubuntu MAAS (1.2/1.4) exposed via the MAAS API, enabling an attacker to read/modify data within the same domain. The Ubuntu USN-2105-1 advisory fixes this by updating maas-region-controller and python-django-maas on Ubuntu 13.10, 12.10, and...
CVE-2013-1069
Ubuntu Metal as a Service MaaS 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file...
CVE-2013-1070
The CVE-2013-1070 entry concerns Ubuntu MAAS (Metal as a Service) API XSS on the nodes/ op parameter in MAAS 1.2 and 1.4. The connected Ubuntu USN-2105-1 describes two issues: (1) a cross-site scripting vulnerability in the MAAS API that could allow an attacker to modify contents or steal data wi...
CVE-2013-1070
Cross-site scripting XSS vulnerability in the API in Ubuntu Metal as a Service MaaS 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/...
Ubuntu Update for maas USN-2105-1
Check for the Version of maas OpenVAS Vulnerability Test $Id: gbubuntuUSN21051.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for maas USN-2105-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...
Ubuntu: Security Advisory (USN-2105-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 12.04 LTS / 12.10 / 13.10 : maas vulnerabilities (USN-2105-1)
James Troup discovered that MAAS stored RabbitMQ authentication credentials in a world-readable file. A local authenticated user could read this password and potentially gain privileges of other user accounts. This update restricts the file permissions to prevent unintended access. CVE-2013-1069...
CVE-2013-1069
Ubuntu Metal as a Service MaaS 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file...
USN-2105-1: MAAS vulnerabilities
James Troup discovered that MAAS stored RabbitMQ authentication credentials in a world-readable file. A local authenticated user could read this password and potentially gain privileges of other user accounts. This update restricts the file permissions to prevent unintended access. CVE-2013-1069...
CVE-2013-1070
Cross-site scripting XSS vulnerability in the API in Ubuntu Metal as a Service MaaS 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/...
CVE-2013-1058
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle MITM attack...
Code injection
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle MITM attack...
CVE-2013-1058
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle MITM attack...
CVE-2013-1058
The CVE-2013-1058 entry affects MAAS: the component maas-import-pxe-files in MAAS prior to 13.10 does not cryptographically verify downloaded content, allowing an attacker to modify images via a MITM. Impact: potential integrity compromise of downloaded PXE/boot data. Affected version line is MAA...
CVE-2013-1057
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse importpxefiles configuration file in the current working directory...
Design/Logic Flaw
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse importpxefiles configuration file in the current working directory...
[USN-2013-1] MAAS vulnerabilities
========================================================================== Ubuntu Security Notice USN-2013-1 November 07, 2013 maas vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...