openshift_container_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/openshift_container_platform/ Sun, 26 Feb 2023 06:49:50 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png openshift_container_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/openshift_container_platform/ 32 32 CVE-2018-3830 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3830/ Sun, 26 Feb 2023 06:49:50 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3830/ Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

The post CVE-2018-3830 appeared first on CVE Vulnerability.

]]> Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

The post CVE-2018-3830 appeared first on CVE Vulnerability.

]]> CVE-2018-14719 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-14719/ Sun, 26 Feb 2023 06:46:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-14719/ FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

The post CVE-2018-14719 appeared first on CVE Vulnerability.

]]> FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

The post CVE-2018-14719 appeared first on CVE Vulnerability.

]]> CVE-2018-14718 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-14718/ Sun, 26 Feb 2023 06:46:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-14718/ FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

The post CVE-2018-14718 appeared first on CVE Vulnerability.

]]> FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

The post CVE-2018-14718 appeared first on CVE Vulnerability.

]]> CVE-2018-11307 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-11307/ Sun, 26 Feb 2023 06:45:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-11307/ An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

The post CVE-2018-11307 appeared first on CVE Vulnerability.

]]> An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

The post CVE-2018-11307 appeared first on CVE Vulnerability.

]]> CVE-2020-27786 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-27786/ Sun, 26 Feb 2023 06:40:27 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-27786/ A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for […]

The post CVE-2020-27786 appeared first on CVE Vulnerability.

]]> A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The post CVE-2020-27786 appeared first on CVE Vulnerability.

]]> CVE-2020-27777 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-27777/ Sun, 26 Feb 2023 06:40:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-27777/ A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a […]

The post CVE-2020-27777 appeared first on CVE Vulnerability.

]]> A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

The post CVE-2020-27777 appeared first on CVE Vulnerability.

]]> CVE-2020-1741 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1741/ Sun, 26 Feb 2023 06:38:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1741/ A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user’s browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is […]

The post CVE-2020-1741 appeared first on CVE Vulnerability.

]]> A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user’s browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.

The post CVE-2020-1741 appeared first on CVE Vulnerability.

]]> CVE-2020-1726 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1726/ Sun, 26 Feb 2023 06:38:28 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1726/ A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible […]

The post CVE-2020-1726 appeared first on CVE Vulnerability.

]]> A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

The post CVE-2020-1726 appeared first on CVE Vulnerability.

]]> CVE-2020-1708 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1708/ Sun, 26 Feb 2023 06:38:25 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1708/ It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their […]

The post CVE-2020-1708 appeared first on CVE Vulnerability.

]]> It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/mysql-apb.

The post CVE-2020-1708 appeared first on CVE Vulnerability.

]]> CVE-2020-1706 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1706/ Sun, 26 Feb 2023 06:38:24 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1706/ It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. […]

The post CVE-2020-1706 appeared first on CVE Vulnerability.

]]> It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.

The post CVE-2020-1706 appeared first on CVE Vulnerability.

]]>