kubernetes security update

1.11.3-2.7.2 - OLCNE-494 CVE-2019-11244 fix CVE-2019-11244: 'kubectl --http-cache=' - creates world-writeable cached schema files 1.11.3.2.6.2 - OLCNE-384 CVE-2019-11243 rest.AnonymousClientConfig does not remove the serviceaccount credentials from config created by rest.InClusterConfig...

kubernetes security update

1.12.7-1.2.3 - OLCNE-494 CVE-2019-11244 fix CVE-2019-11244: 'kubectl --http-cache=' - creates world-writeable cached schema files 1.12.7-1.1.3 - OCNE-372 kubeadm: properly umount dirs in /var/lib/kubelet...

kubernetes security update

1.9.11-2.7.1 - OLCNE-494 CVE-2019-11244 fix CVE-2019-11244: 'kubectl --http-cache=' - creates world-writeable cached schema files 1.9.11-2.6.1 - OLCNE-382 CVE-2019-11243 rest.AnonymousClientConfig does not remove the sa credentials...

HackerOne: Private information exposed through GraphQL filters

Summary: secure schema can be circumvented for graphql where filters by using or operator. Description: When passing a where clause to a collection in the graphql endpoint, like teamswhere: state: eq: softlaunched it queries the state through the secure schema - so it will not return any teams...

UPDATE: OWASP Dependency-Check 5.1.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. Some days back, a new version was released. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP...

io.hawt:hawtio-aether (1.4.5), io.hawt:hawtio-base (1.4.5) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.5)

io.hawt:hawtio-core MAVEN version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.5 - io.hawt:hawtio-base 1.4.5 - io.hawt:hawtio-dozer 1.4.5 - io.hawt:hawtio-git 1.4.5 -...

io.hawt:hawtio-aether (1.4.8), io.hawt:hawtio-base (1.4.8) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.8)

io.hawt:hawtio-core MAVEN version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.8 - io.hawt:hawtio-base 1.4.8 - io.hawt:hawtio-dozer 1.4.8 - io.hawt:hawtio-git 1.4.8 -...

io.hawt:hawtio-aether (1.4.61), io.hawt:hawtio-base (1.4.61) +17 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.61)

io.hawt:hawtio-core MAVEN version 1.4.61 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.61 - io.hawt:hawtio-base 1.4.61 - io.hawt:hawtio-dozer 1.4.61 - io.hawt:hawtio-git 1.4.61 -...

io.hawt:hawtio-aether (1.2-m1), io.hawt:hawtio-git (1.2-m1) +5 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m1)

io.hawt:hawtio-core MAVEN version 1.2-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m1 - io.hawt:hawtio-git 1.2-m1 - io.hawt:hawtio-json-schema-generator-plugin 1.2-m1 -...

io.hawt:hawtio-aether (1.2-m2), io.hawt:hawtio-dozer (1.2-m2) +9 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m2)

io.hawt:hawtio-core MAVEN version 1.2-m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m2 - io.hawt:hawtio-dozer 1.2-m2 - io.hawt:hawtio-git 1.2-m2 -...

io.hawt:hawtio-aether (1.4.16), io.hawt:hawtio-base (1.4.16) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.16)

io.hawt:hawtio-core MAVEN version 1.4.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.16 - io.hawt:hawtio-base 1.4.16 - io.hawt:hawtio-dozer 1.4.16 - io.hawt:hawtio-git 1.4.16 -...

io.hawt:hawtio-aether (1.2.2), io.hawt:hawtio-base (1.2.2) +7 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2.2)

io.hawt:hawtio-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2.2 - io.hawt:hawtio-base 1.2.2 - io.hawt:hawtio-dozer 1.2.2 - io.hawt:hawtio-git 1.2.2 -...

io.hawt:hawtio-aether (1.2-m5), io.hawt:hawtio-base (1.2-m5) +8 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m5)

io.hawt:hawtio-core MAVEN version 1.2-m5 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m5 - io.hawt:hawtio-base 1.2-m5 - io.hawt:hawtio-dozer 1.2-m5 - io.hawt:hawtio-git 1.2-m5 -...

io.hawt:hawtio-aether (1.4.67), io.hawt:hawtio-base (1.4.67) +17 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.67)

io.hawt:hawtio-core MAVEN version 1.4.67 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.67 - io.hawt:hawtio-base 1.4.67 - io.hawt:hawtio-dozer 1.4.67 - io.hawt:hawtio-git 1.4.67 -...

io.hawt:hawtio-aether (1.4.59), io.hawt:hawtio-base (1.4.59) +17 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.59)

io.hawt:hawtio-core MAVEN version 1.4.59 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.59 - io.hawt:hawtio-base 1.4.59 - io.hawt:hawtio-dozer 1.4.59 - io.hawt:hawtio-git 1.4.59 -...

io.hawt:hawtio-aether (1.4.14), io.hawt:hawtio-base (1.4.14) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.14)

io.hawt:hawtio-core MAVEN version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.14 - io.hawt:hawtio-base 1.4.14 - io.hawt:hawtio-dozer 1.4.14 - io.hawt:hawtio-git 1.4.14 -...

@cameronhunter/jest-json-schema (2.1.0), @limedocs/core (>=1.0.0-beta.1, <=1.0.0-beta.13) +3 more potentially affected by unknown CVE via url-relative (1.0.0)

url-relative NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on url-relative and may be impacted: - @cameronhunter/jest-json-schema 2.1.0 - @limedocs/core =1.0.0-beta.1, =0.9.0, =0.16.16 Source cves: unknown CVE Source advisory:...

Freelance Cockpit CRM 3.3.1 SQL Injection

=========================================================================================== Exploit Title: Freelance Cockpit CRM - SQL Inj. Dork: N/A Date: 17-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.freelancecockpit.com/ Software Link: https://www.freelancecockpit.com...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS attacks. Vulnerability exists in the subcomponent Server: Performance Schema in the MySQL Server component of Oracle MySQL. A high privileged attacker with network access via multiple protocols could compromise MySQL Server resulting in a frequently...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated user with high privileges could compromise MySQL Server via multiple protocols resulting in a system crash. Affected is the component Performance Schema...