Archive
7 December 2020
Vulnerabilities first published on this day (UTC), newest first.
23 results · Feed
-
Medium 4.7
Secret leaks in logs for vSphere Provider kube-controller-manager
In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.
-
Medium 4.7
Docker config secrets leaked when file is malformed and loglevel >= 4
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v…
-
Medium 4.7
Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-al…
-
Medium 4.7
Ceph RBD adminSecrets exposed in logs when loglevel >= 4
In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1…
-
Unscored —
Local symlink attack in Unbound and NSD
NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not t…
-
Unscored —
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only re…
-
Medium 5.5
Information Disclosure in Apache Groovy
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems…
-
Unscored —
IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows u…
-
Unscored —
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the…
-
Unscored —
PlugIns\IDE_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV startin…
-
Unscored —
Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. Th…
-
Unscored —
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM…
-
Unscored —
An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries gi…
-
Unscored —
There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain …
-
Unscored —
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user f…
-
Unscored —
The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and re…
-
Unscored —
The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privile…
-
Unscored —
crate has been renamed to `sn_client`
This crate has been renamed from `safe_core` to `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
crate has been renamed to `sn_node`
This crate has been renamed from `safe_vault` to `sn_node`. The new repository location is: <https://github.com/maidsafe/sn_node>
-
Unscored —
crate has been superseded by `sn_client`
This crate has been superseded by `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
crate has been superseded by `sn_client`
This crate has been superseded by `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChoos…
-
Unscored —CVE-2020-29599 Public exploit
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a passw…