Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...

IBM UrbanCode Deploy Security Bypass Vulnerability (CNVD-2020-63484)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

Kernel update: Virtuozzo ReadyKernel patch 118.1 for Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 3.0, and Virtuozzo Hybrid Infrastructure 3.5, 4.0

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform, and Virtuozzo Hybrid Infrastructure. Vulnerability id: PSBM-121135 3.10.0-1127.8.2.vz7.151.14 to...

CVE-2020-4482

IBM UrbanCode Deploy (UCD) versions affected by CVE-2020-4482 include 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0. A security bypass vulnerability exists where an authenticated user with access to a snapshot can call REST endpoints to apply unauthorized additional statuses, effectively bypassing secur...

Security Bulletin: CVE-2020-4482 ADD SNAPSHOT STATUS REST CALL DOESN'T CHECK THE USER ROLE

Summary ADD SNAPSHOT STATUS REST CALL DOESN'T CHECK THE USER ROLE BEFORE ADDING THE STATUS TO SNAPSHOT Vulnerability Details CVEID: CVE-2020-4482 DESCRIPTION: IBM UrbanCode Deploy UCD could allow an authenticated user to bypass security. A user with access to a snapshot could apply unauthorized...

Release Information for Huawei Plug-In for Veeam Backup & Replication

Huawei Plug-In - End of Life The Huawei Plug-In for Veeam Backup & Replication reached End-of-Life on 2022-04-22 and is no longer available. Requirements Before installing Huawei Plug-In v1.0.23, ensure that you are running Veeam Backup & Replication 10.0.0.4461 or later. To check the version, op...

Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version: snapshot-controller from external-snapshotter repo ver 3.0.0 https://github.com/kubernetes-csi/external-snapshotter/releases/tag/v3.0.0...

SUSE-SU-2020:2715-1 Security update for grafana

This update for grafana fixes the following issues: - CVE-2020-11110: Fixed a stored XSS in dashboard snapshot original dashboard link bsc1174583...

Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x

By Cory Duplantis. One of the ways vulnerability researchers find bugs is with fuzzing. At a high level, fuzzing is the process of generating and mutating random inputs for a given target to crash it. In 2017, I started developing a bare metal hypervisor for the purposes of snapshot fuzzing:...

Exploit for Missing Authentication for Critical Function in Grafana

CVE-2019-15043 POC Description Proof of concept scan to c...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Input validation

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

UBUNTU-CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548, CVE-2015-8749 CVE-2015-1850)

Summary IBM SmartClound Entry is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information Vulnerability Details CVEID: CVE-2015-8749 DESCRIPTION: OpenStack Nova could allow a remote attacker to obtai...

Unspecified Vulnerability in NeDi Consulting NeDi (CNVD-2020-44583)

NeDi Consulting NeDi is a suite of open source software that supports discovery and mapping of network devices from the Swiss company NeDi Consulting. A security vulnerability exists in NeDi Consulting NeDi version 1.9C, which stems from the System-Snapshot.php file not properly escaping shell...

CVE-2020-14412

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...

Release Information for Veeam Backup for AWS v2

Requirements IMPORTANT You cannot update Veeam Backup for AWS operating in the Paid edition to version 2.0 from the Veeam Backup for AWS Web UI. To update the product, you must install Veeam Backup for AWS version 2.0 from AWS Marketplace on a new EC2 instance, and then migrate Veeam Backup for A...

Changed block tracking cannot be enabled: one or more snapshots are present

Challenge After upgrade to Veeam Backup & Replication 10, the Backup of a VM using Cisco HyperFlex Snapshots completes with the warning "Changed block tracking cannot be enabled: one or more snapshots are present" if a Sentinel snapshot is already present. The described issue with Cisco HyperFlex...