CVE-2018-1079

It was found that the REST interface of the pcsd service did not properly sanitize the file name from the /remote/putfile query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the...

CVE-2018-1086

It was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /runpcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

UBUNTU-CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

Session fixation

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

DEBIAN-CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0721

CVE-2016-0721 describes a session fixation vulnerability in pcsd (part of the PCS/Corosync-Pacemaker tooling) affecting pcs before 0.9.157. The issue arises from how sessions are managed, potentially allowing an attacker to hijack an authenticated session. Affected product: pcs/pcsd components pr...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

CVE-2016-0720 is a CSRF flaw in the pcsd web UI of the ClusterLabs pcs before 0.9.149. The vulnerability allows remote attackers to trigger state-changing requests via the web interface. Affected component: pcsd web UI (pcs before 0.9.149). Documented impact is implied by CSRF risk; explicit expl...

CVE-2017-2661

It was found that pcsd was vulnerable to reflected cross-site scripting XSS attacks while handling node names during creation or import of a cluster. An attacker could use this flaw to run javascript code in an authenticated session...

pcs: Cross-Site Request Forgery in web UI

A Cross-Site Request Forgery CSRF flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or...