CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3876 – web-console: XSS in OAuth server /oauth/token/request endpoint
https://notcve.org/view.php?id=CVE-2019-3876
A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens. Se ha detectado un fallo en el endpoint personalizado en /oauth/token/request del servidor OpenShift OAuth, permitiendo la generación de Cross-Site Scripting (XSS) de tokens CLI debido a la falta de X-Frame-Options y protecciones de Cross-Site Request Forgery (CSRF). Si no se previene, una vulnerabilidad de Cross-Site Scripting (XSS) separada mediante JavaScript podría permitir la extracción de estos tokens • http://www.securityfocus.com/bid/107664 https://access.redhat.com/errata/RHSA-2019:1851 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3876 https://access.redhat.com/security/cve/CVE-2019-3876 https://bugzilla.redhat.com/show_bug.cgi?id=1691107 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 1CVE-2019-1002101 – kubectl cp path traversal
https://notcve.org/view.php?id=CVE-2019-1002101
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. • https://github.com/brompwnie/CVE-2019-1002101-Helpers http://www.openwall.com/lists/oss-security/2019/06/21/1 http://www.openwall.com/lists/oss-security/2019/08/05/5 http://www.securityfocus.com/bid/107652 https://access.redhat.com/errata/RHBA-2019:0619 https://access.redhat.com/errata/RHBA-2019:0620 https://access.redhat.com/errata/RHBA-2019:0636 https://access.redhat.com/security/cve/cve-2019-1002101 https://github.com/kubernetes/kubernetes/pull/75037 https:/&#x • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-1002100 – kube-apiserver: DoS with crafted patch of type json-patch
https://notcve.org/view.php?id=CVE-2019-1002100
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server. En todas las versiones de Kubernetes anteriores a las v1.11.8, v1.12.6 y v1.13.4, los usuarios autorizados para realizar peticiones de parche en el servidor API de Kubernetes pueden enviar parches "json-patch" (p.ej., `kubectl patch --type json` o `"Content-Type: application/json-patch+json"`) especialmente manipulados que consumen recursos excesivos durante el procesamiento, conduciendo a una denegación de servicio (DoS) en el servidor API A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service. • http://www.securityfocus.com/bid/107290 https://access.redhat.com/errata/RHSA-2019:1851 https://access.redhat.com/errata/RHSA-2019:3239 https://github.com/kubernetes/kubernetes/issues/74534 https://groups.google.com/forum/#%21topic/kubernetes-announce/vmUUNkYfG9g https://security.netapp.com/advisory/ntap-20190416-0002 https://access.redhat.com/security/cve/CVE-2019-1002100 https://bugzilla.redhat.com/show_bug.cgi?id=1683190 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.8EPSS: 2%CPEs: 4EXPL: 0CVE-2019-0542 – xterm.js: Mishandling of special characters allows for remote code execution
https://notcve.org/view.php?id=CVE-2019-0542
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js. Existe una vulnerabilidad de ejecución remota de código en Xterm.js cuando el componente maneja mal los caracteres especiales, también conocida como "Xterm Remote Code Execution Vulnerability". Esto afecta a xterm.js It was found that xterm.js does not sanitize terminal escape sequences in browser terminals allowing for execution of arbitrary commands. An attacker could exploit this by convincing a user with a xterm.js browser terminal to display an escape sequence by, for example, reading a from a log file containing attacker-controlled input. • http://www.securityfocus.com/bid/106434 https://access.redhat.com/errata/RHBA-2019:0959 https://access.redhat.com/errata/RHSA-2019:1422 https://access.redhat.com/errata/RHSA-2019:2551 https://access.redhat.com/errata/RHSA-2019:2552 https://github.com/xtermjs/xterm.js/releases https://access.redhat.com/security/cve/CVE-2019-0542 https://bugzilla.redhat.com/show_bug.cgi?id=1668531 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 5%CPEs: 58EXPL: 0CVE-2018-14718 – jackson-databind: arbitrary code execution in slf4j-ext class
https://notcve.org/view.php?id=CVE-2018-14718
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. Las versiones 2.x de FasterXML jackson-databind anteriores a la 2.9.7 podrían permitir a los atacantes remotos ejecutar código arbitrario aprovechando un fallo para bloquear la clase slf4j-ext de deserialización polimórfica. A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code. • http://www.securityfocus.com/bid/106601 https://access.redhat.com/errata/RHBA-2019:0959 https://access.redhat.com/errata/RHSA-2019:0782 https://access.redhat.com/errata/RHSA-2019:0877 https://access.redhat.com/errata/RHSA-2019:1782 https://access.redhat.com/errata/RHSA-2019:1797 https://access.redhat.com/errata/RHSA-2019:1822 https://access.redhat.com/errata/RHSA-2019:1823 https://access.redhat.com/errata/RHSA-2019:2804 https://access.redhat.com/errata/RHSA-2019:2858& • CWE-502: Deserialization of Untrusted Data •