kubernetes security update

1.9.11-2.7.1 - OLCNE-494 CVE-2019-11244 fix CVE-2019-11244: 'kubectl --http-cache= ' - creates world-writeable cached schema files 1.9.11-2.6.1 - OLCNE-382 CVE-2019-11243 rest.AnonymousClientConfig does not remove the sa credentials...

HackerOne: Private information exposed through GraphQL filters

Summary: secure schema can be circumvented for graphql where filters by using or operator. Description: When passing a where clause to a collection in the graphql endpoint, like teamswhere: state: eq: softlaunched it queries the state through the secure schema - so it will not return any teams...

UPDATE: OWASP Dependency-Check 5.1.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. Some days back, a new version was released. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP...

@cameronhunter/jest-json-schema (=2.1.0), @limedocs/core (>=1.0.0-beta.1 <=1.0.0-beta.13) +3 more potentially affected by unknown CVE via url-relative (=1.0.0)

url-relative NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on url-relative and may be impacted: - @cameronhunter/jest-json-schema =2.1.0 - @limedocs/core =1.0.0-beta.1, =0.9.0, =0.16.16 Source cves: unknown CVE Source advisory:...

Freelance Cockpit CRM 3.3.1 SQL Injection

=========================================================================================== Exploit Title: Freelance Cockpit CRM - SQL Inj. Dork: N/A Date: 17-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.freelancecockpit.com/ Software Link: https://www.freelancecockpit.com...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS attacks. Vulnerability exists in the subcomponent Server: Performance Schema in the MySQL Server component of Oracle MySQL. A high privileged attacker with network access via multiple protocols could compromise MySQL Server resulting in a frequently...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated user with high privileges could compromise MySQL Server via multiple protocols resulting in a system crash. Affected is the component Performance Schema...

Latest Bypassing Techniques Beat SOAP/XML API Protection

It is impossible to protect APIs unless you take a deep dive into the protocols implemented over the standard HTTP. Most security tools are not protecting data where it’s most vulnerable, inside the XML schema itself. These encoding attacks are going unflagged by many application platforms, despi...

Latest Bypassing Techniques Beats SOAP/XML API Protection

Latest Bypassing Techniques Beat SOAP/XML API Protection It is impossible to protect APIs unless you take a deep dive into the protocols implemented over the standard HTTP. Most security tools are not protecting data where it’s most vulnerable, inside the XML schema itself. These encoding attacks...

Fedora Update for jackson-module-jsonSchema FEDORA-2019-df57551f6d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote, authenticated attacker could exploit the flawed Performance Schema component to cause a hang or frequently repeatable crash resulting in denial of service conditions...

Improper Access Control

MySQL is using improper access control. It allows remote authenticated users to affect availability via unknown vectors related to Information Schema...

Vulnerability of the Server component: The Information Schema of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

Vulnerability of the Server component: The information schema of the Oracle MySQL Server database management system is vulnerable due to a lack of access control. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

CVE-2019-2631

Mode C: CVE-2019-2631 is a vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Information Schema). Affected versions are 8.0.15 and earlier. It allows a high-privileged attacker who can access the server over network protocols to cause the MySQL Server to hang or crash (co...

Design/Logic Flaw

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244 kubectl creates world-writeable cached schema files

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-10370)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Information Schema subcomponent of the MySQL Server component of Oracle MySQL, version 8.0.15 and...

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

In kubectl v1.8.0+, schema info is cached in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be...