UBUNTU-CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf...

CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf...

mysql: pid file can be created in a world-writeable directory (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where...

Securing financial data of the future: behavioral biometrics explained

Some of us would be pretty excited about a brave, new passwordless world. Gone would be the days of having to write down 27 passwords and post them beside monitor screens. Or having to yell them out loud to a colleague on the other side of the room. For banks and other financial institutions, a...

Arbitrary File Overwrite

JSNAPy is vulnerable to arbitrary file overwrite attacks. The default configuration and sample files are created world writable, allowing a local malicious user to edit files in the /etc/jsnapy directory...

Default configuration

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows...

PYSEC-2018-84

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows...

Junos Snapshot Administrator (JSNAPy) world writeable default configuration file permission

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows...

CVE-2018-0023 Junos Snapshot Administrator (JSNAPy) world writeable default configuration file permission

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows...

openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...

File Permission Manipulation Via Symlink Attack

hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable...

Information disclosure

Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files...

CVE-2014-5450

Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files...

CVE-2014-5450

CVE-2014-5450 concerns Zarafa Collaboration Platform 4.1, where /etc/zarafa/license was created with world-readable permissions, enabling local users to read license files and disclose sensitive information. Public sources in connected documents indicate this issue stems from incorrect default pe...

The ‘Perfect Storm’ of Disinformation and Hacking

We live in an age of fake news, misinformation and disinformation. Recently, we have been falling for it – mostly. That is largely thanks to a confluence of social media, hacking and good old fashion disinformation campaigns, according to Matt “Pwn all the Things” Tait, a senior cybersecurity...

openSUSE Security Update : postgresql94 (openSUSE-2018-257)

This update for postgresql94 fixes the following issues : PostgreSQL was updated to version 9.4.15, the full release notes are here : https://www.postgresql.org/docs/9.4/static/release-9-4-15.html - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc107798...

SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0675-1)

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.15, the full release notes are here: https://www.postgresql.org/docs/9.4/static/release-9-4-15.html - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983...

Trend Micro at MWC: Securing Our Mobile, Connected World

Time flies pretty fast in tech. When Trend Micro was founded nearly 30 years ago, mobile phones were pretty clunky, prohibitively expensive and not in the least bit “smart.” Fast forward to today and the device in your pocket has more compute power than the NASA machines that put man on the moon...

openSUSE Security Update : postgresql96 (openSUSE-2018-203)

This update for postgresql96 to version 9.6.7 fixes the following issues : - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983 A full changelog is available here : https://www.postgresql.org/docs/9.6/static/release-9-6-7.html This update was...

pulp: Leakage of CA key in pulp-qpid-ssl-cfg

It was found that the private CA key was created in a directory that is world-readable for a small amount of time. A local user could possibly use this flaw to gain access to the private key information in the file...