192 matches found
CVE-2021-38417 VISAM VBASE Editor Improper Access Control
VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...
Malicious Package
pygrata-utils is a malicious package. The library attempts to harvest and upload the AWS credentials, network interface information and environment variables to a remote endpoint: "hxxp://graph.pygrata.com:8000/upload."...
Palo Alto Networks Cortex XDR Information Disclosure Vulnerability
Palo Alto Networks Cortex XDR is a security operations platform for remote endpoint-based detection from Palo Alto Networks Malaysia. A security vulnerability exists in the Palo Alto Networks Cortex XDR agent that can be exploited by an attacker to read the contents of any file on the system with...
GLSA-202107-50 : Singularity: Remote code execution
The remote host is affected by the vulnerability described in GLSA-202107-50 Singularity: Remote code execution Singularity always uses the default remote endpoint, cloud.syslabs.io, for action commands using the library:// URI rather than the configured remote endpoint. Impact : An attacker that...
MGASA-2022-0006 Updated singularity packages fix security vulnerability
A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...
Updated singularity packages fix security vulnerability
A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...
Singularity: Remote code execution
Background Singularity is the container platform for performance sensitive workloads. Description Singularity always uses the default remote endpoint, ‘cloud.syslabs.io’, for action commands using the ‘library://’ URI rather than the configured remote endpoint. Impact An attacker that that can pu...
Insecure Container Configuration
github.com/hpcng/singularity uses insecure container configuration. An attacker is able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint...
GHSA-5MV9-Q7FQ-9394 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...
GHSA-JQ42-HFCH-42F3 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...
CVE-2021-32635
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint...
CVE-2021-32635 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint...
CVE-2021-32635
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint...
CVE-2021-32635
Removed by vendor...
CVE-2021-32635
Summary (CVE-2021-32635) : Singularity (open source container platform) versions 3.7.2–3.7.3 expose a flaw where action commands using a library:// URI ignore the configured remote endpoint and always fetch from the default endpoint cloud.sylabs.io. This can allow an attacker to push a malicious ...
CVE-2021-24167
When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...
Design/Logic Flaw
In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found...
