CVE-2019-11244

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244 kubectl creates world-writeable cached schema files

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-10370)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Information Schema subcomponent of the MySQL Server component of Oracle MySQL, version 8.0.15 and...

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

In kubectl v1.8.0+, schema info is cached in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be...

PT-2019-1963 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.15 and prior Description: The issue is related to a lack of access control in the MySQL Server component, specifically in the Server: Information Schema subcomponent. This allows a high-privileged attacker with netwo...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2019:0609-1)

This update for mariadb to version 10.2.22 fixes the following issues : Security issues fixed bsc1122198 : CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service. CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to...

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting

Exploit for multiple platform in category web applications Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 ...

OrientDB 3.0.17 GA Community Edition - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

OrientDB 3.0.17 GA Community Edition XSS / CSRF

Exploit Title: OrientDB 3.0.17 GA Community Edition March 7th, 2019 | Multiple Vulnerabilities Date: 07.03.2019 Exploit Author: Ozer Goker Vendor Homepage: https://orientdb.org Software Link: https://orientdb.org/download Version: 3.0.17 GA Community Edition March 7th, 2019 Introduction OrientDB ...

[SECURITY] Fedora 29 Update: jackson-module-jsonSchema-2.9.8-1.fc29

Add-on module for to support JSON Schema version 3 generation...

Vulnerability of the Server component: The information schema of the MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server component: The information schema of the Oracle MySQL database management system is related to insufficient access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:GHSA-FVXV-9XXR-H7WJ...

azureml-webservice-schema (>=0.1.57 <=1.0.33), gnuper (=0.0.3) +4 more potentially affected by CVE-2018-11760 via pyspark (>=2.3.0 <=2.3.1)

pyspark PYPI version =2.3.0, =0.1.57, =2.0.3, =0.2.0, =0.2.4 Source cves: CVE-2018-11760 Source advisory: OSV:PYSEC-2019-169...

Joomla J-BusinessDirectory 4.9.7 Component - type SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://cmsjunkie.com/ Software Link:...

Cross-site Scripting (XSS)

spacewalk-schema is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as a cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attack...

Modern POS 1.3 - SQL Injection

Exploit Title: Modern POS 1.3 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://itsolution24.com/ Software Link: https://codecanyon.net/item/modern-pos-point-of-sale-with-stock-management-system/22702683 Version: 1.3 Category: Webapps Tested on:...

biobb-io (>=0.0.1 <=0.0.8), biobb-model (>=0.0.1 <=0.0.10) +6 more potentially affected by CVE-2017-16876 via mistune (>=0.7.3 <=0.7.4)

mistune PYPI version =0.7.3, =0.0.1, =0.0.1, =0.0.6, =0.2.1, =2.2.20170208112505, =0.1.0, =0.1.2, =0.3.2 Source cves: CVE-2017-16876 Source advisory: OSV:GHSA-98GJ-WWXM-CJ3H...

[SECURITY] Fedora 29 Update: python-lxml-4.2.5-1.fc29

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

CouchDB: Multiple vulnerabilities

Background Apache CouchDB is a distributed, fault-tolerant and schema-free document-oriented database. Description Multiple vulnerabilities have been discovered in CouchDB. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code or...

Microsoft SharePoint Server Information Disclosure Vulnerability

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...