2003 matches found
Updated crmsh packages fix security vulnerability
The crm configure and hbreport commands failed to sanitize sensitive information by default bsc1163581. An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" when "crm" is run were able to execute commands via shell code injection to the crm histor...
Nagios Log Server Cross-Site Scripting Vulnerability (CNVD-2021-05455)
Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. Nagios Log Server version 2.1.7 cross-site scripting vulnerability, the vulnerability stems from the nagioslogserver configuration snapshotname parameter is not filtered for user input, an...
CVE-2020-8569
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...
CVE-2020-8569
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...
Design/Logic Flaw
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...
CVE-2020-8569
CVE-2020-8569 affects the Kubernetes CSI external snapshot-controller when processing a VolumeSnapshot CR that references a non-existent PersistentVolumeClaim and lacks a VolumeSnapshotClass. The root cause is a NULL pointer dereference which can cause the snapshot-controller to crash and, after ...
CVE-2020-8569 Kubernetes CSI snapshot-controller DoS
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...
Kubernetes Code Issues Vulnerabilities
Kubernetes is an open source Docker container cluster management system from the Linux Foundation. The system provides resource scheduling, deployment operations, service discovery, and scaling up and down for containerized applications. A code issue vulnerability exists in Kubernetes CSI...
CVE-2020-25385
Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...
CVE-2020-25385
Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...
CVE-2020-25385
Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...
Nagios Log Server 跨站脚本漏洞
Nagios Log Server is a set of centralized log management, monitoring and analysis software from Nagios, Inc. Nagios Log Server version 2.1.7 cross-site scripting vulnerability, the vulnerability stems from the nagioslogserver configuration snapshotname parameter is not filtered for user input, an...
IBM HTTP Server 7.0.0.0 <= 7.0.0.43 / 8.0.0.0 <= 8.0.0.14 / 8.5.0.0 < 8.5.5.14 / 9.0.0.0 < 9.0.0.8 Multiple Vulnerabilities (569301)
The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, including the following: - IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which cou...
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...
CVE-2020-27900
An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...
Code injection
An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...
CVE-2020-27900
An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to...
Denial Of Service (DoS)
github.com/kubernetes-csi/external-snapshotter is vulnerable to denial of service. A NULL pointer dereference in the snapshot-controller allows an attacker to crash the application via authorized API requests...
CVE-2020-8569
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes...
CVE-2020-8569
A flaw was found in the Kubernetes snapshot-controller, where it is vulnerable to a denial of service attack via authorized API requests. The snapshot-controller can dereference a NULL pointer when processing a VolumeSnapshot custom resource via an authorized API request with invalid references t...