1972 matches found
openstack-nova: Unprivileged API user can access host data using instance snapshot
A flaw was discovered in the OpenStack Compute nova snapshot feature when using the libvirt driver. A compute user could overwrite an attached instance disk with a malicious header specifying a backing file, and then request a snapshot, causing a file from the compute host to be leaked. This flaw...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
UBUNTU-CVE-2015-5299
The shadowcopy2getshadowcopydata function in modules/vfsshadowcopy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORYLIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy...
User Picker Custom field HTML tags showing when creating new issues
h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...
User Picker Custom field HTML tags showing when creating new issues
h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...
Understanding Garbage Collection and Coalesce Process Troubleshooting
Summary In most cases, customers have experienced issues with coalescing snapshots after deleting snapshots. At times we do notsee the reclaimed space once a snapshot is deleted. Even with an SR rescan to manually get the Garbage Collection GC to kick-in does not reclaim space. This article...
VM does not meet the requirements for storage snapshot based jobs
Challenge A task utilizing storage snapshot integration fails with any of the following errors: VM does not meet requirements for storage snapshot based jobs: its virtual disks are not located on supported storage VM does not meet requirements for storage snapshot based jobs: its files are locate...
SUSE-SU-2015:2065-1 Security update for dracut
The dracut package was updated to fix the following security and non-security issues: - CVE-2015-0794: Use mktemp instead of hardcoded filenames, possible vulnerability bsc935338. - Always install mdraid modules bsc935993. - Add notice when dracut failed to install modules bsc952491. - Always...
ElasticSearch Snapshot API Directory Traversal
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 'ElasticSearch Snapshot API Directory Traversal', 'Description' = %q This module exploits a directory traversal...
ElasticSearch Snapshot API Directory Traversal
'This module exploits a directory traversal vulnerability in ElasticSearch, allowing an attacker to read arbitrary files with JVM process privileges, through the Snapshot API.' This module requires Metasploit: https://metasploit.com/download Current source:...
SUSE: Security Advisory for ppc64-diag (SUSE-SU-2014:0928-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2015-3878
Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal bug 23345192...
Oracle: Security Advisory (ELSA-2013-0276)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ElasticSearch 1.7.2 Cloud-Azure Insecure Transit Vulnerability
The connection string for ELK cloud-azure plugin contains hardcoded http url with the lack of encryption and certificate validation, therefore it is prone to sniffing and MiTM attacks. A potential attacker with the required access to the network traffic would be able to intercept the content of t...
The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a perpetrator to gain access to protected data with hashed passwords.
The vulnerability of the System Snapshot extension in microprogramming software for Cisco TelePresence Video Communication Servers lies in the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected data using...
Code injection
CheckMK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...
CVE-2014-2331
CheckMK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...
UBUNTU-CVE-2014-2331
CheckMK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...