CVE-2020-3393 Cisco IOS XE Software IOx Application Hosting Privilege Escalation Vulnerability

A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the...

CVE-2020-3393

CVE-2020-3393 is a privilege-escalation vulnerability in Cisco IOS XE Software IOx Application Hosting. The issue arises from a combination of incomplete input validation of CLI user payloads and improper RBAC for commands issued in the application-hosting subsystem. An authenticated, local attac...

Cisco IOS XE Software IOx Application Hosting Privilege Escalation Vulnerability

A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the...

CVE-2020-3365

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

Directory traversal

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

CVE-2020-3365 Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

CVE-2020-3365 Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

CVE-2020-3365

CVE-2020-3365 concerns Cisco Enterprise NFV Infrastructure Software (NFVIS) where a flaw in directory-permission logic can let an authenticated, remote attacker perform a directory traversal in a limited set of restricted directories and potentially overwrite files. The issue arises from capabili...

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

Basics of Keeping Kubernetes Clusters Secure Part 1

With Kubernetes’ popularity and high adoption rates, its security should always be prioritized. We provide vital tips and recommendations on keeping the master node, the API server, etcd, RBAC, and network policies secure...

CVE-2020-3485

A vulnerability in the role-based access control RBAC functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to...

Design/Logic Flaw

A vulnerability in the role-based access control RBAC functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to...

CVE-2020-3485 Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability

A vulnerability in the role-based access control RBAC functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to...

CVE-2020-3485

CVE-2020-3485 describes a vulnerability in the web management software of Cisco Vision Dynamic Signage Director’s RBAC. The issue arises from improper handling of RBAC in the web interface, enabling an authenticated, remote attacker to view and delete screen content they should not access via a c...

Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability

A vulnerability in the role-based access control RBAC functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to...

CloudForms: Missing access control leads to escalation of admin group privileges

A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...

Multiple stored XSS in RBAC Admin screens in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks...

Permission Manager - A Project That Brings Sanity To Kubernetes RBAC And Users Management, Web UI FTW

Welcome to the Permission Manager! Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBACmanagement for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this is the right place. Wit...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes kubelet security vulnerability (CVE-2020-8557)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes kubelet that could result in the denial of service of a node CVE-2020-8557 Vulnerability Details CVEID: CVE-2020-8557 Description: Kubernetes kubelet is vulnerable to a denial of service, caused by an...

Apache Airflow RBAC Admin Page Cross-Site Scripting Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in the RBAC Admin page in Apac...