CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

UBUNTU-CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

DEBIAN-CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

CVE-2016-0720 is a CSRF flaw in the pcsd web UI of the ClusterLabs pcs before 0.9.149. The vulnerability allows remote attackers to trigger state-changing requests via the web interface. Affected component: pcsd web UI (pcs before 0.9.149). Documented impact is implied by CSRF risk; explicit expl...

CVE-2016-0721

CVE-2016-0721 describes a session fixation vulnerability in pcsd (part of the PCS/Corosync-Pacemaker tooling) affecting pcs before 0.9.157. The issue arises from how sessions are managed, potentially allowing an attacker to hijack an authenticated session. Affected product: pcs/pcsd components pr...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2016-0721

Session fixation vulnerability in pcsd in pcs before 0.9.157...

CVE-2016-0720

Cross-site request forgery CSRF vulnerability in pcsd web UI in pcs before 0.9.149...

CVE-2017-2661

It was found that pcsd was vulnerable to reflected cross-site scripting XSS attacks while handling node names during creation or import of a cluster. An attacker could use this flaw to run javascript code in an authenticated session...

pcs: Cross-Site Request Forgery in web UI

A Cross-Site Request Forgery CSRF flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or...

PT-2017-7645 · Pacemaker +2 · Pcsd +2

Name of the Vulnerable Software and Affected Versions: pcsd versions prior to 0.9.149 Description: The issue is related to a cross-site request forgery CSRF vulnerability in the pcsd web UI. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Scientific Linux Security Update : pcs on SL7.x x86_64 (20151119)

A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash. CVE-2015-3225 The pcs package has been upgraded to upstream version 0.9.143, which provides a number of bug fixe...

CentOS 7 : pcs (CESA-2015:2290)

An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

pcs security update

CentOS Errata and Security Advisory CESA-2015:2290 An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

RHEL 7 : pcs (RHSA-2015:2290)

An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2015-5189

Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated...

Race condition

Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated...