Darragh Oreilly

**Name of the Vulnerable Software and Affected Versions** Velociraptor versions prior to 0.73.4 **Description** The issue is related to improper access control in the VQL shell feature, allowing authenticated users to execute the `execve()` plugin even when it is explicitly forbidden by the `prevent execve` flag in the configuration file. This setting is not commonly used, so the issue will only affect users who have set it. **Recommendations** For versions prior to 0.73.4, update to release 0.73.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenStack Nova (python-nova) versions 1:2013.2.3-0 through 1:2013.2.3-0ubuntu1.1 and versions 1:2014.1-0 through 1:2014.1-0ubuntu1.1 OpenStack Cinder (python-cinder) versions 1:2013.2.3-0 through 1:2013.2.3-0ubuntu1.0 and versions 1:2014.1-0 through 1:2014.1-0ubuntu1.0 **Description** The issue makes it easier for attackers to gain privileges by leveraging another vulnerability, due to improper sudo configuration setting. **Recommendations** For OpenStack Nova (python-nova) versions 1:2013.2.3-0 through 1:2013.2.3-0ubuntu1.1, update to version 1:2013.2.3-0ubuntu1.2 or later. For OpenStack Nova (python-nova) versions 1:2014.1-0 through 1:2014.1-0ubuntu1.1, update to version 1:2014.1-0ubuntu1.2 or later. For OpenStack Cinder (python-cinder) versions 1:2013.2.3-0 through 1:2013.2.3-0ubuntu1.0, update to version 1:2013.2.3-0ubuntu1.1 or later. For OpenStack Cinder (python-cinder) versions 1:2014.1-0 through 1:2014.1-0ubuntu1.0, update to version 1:2014.1-0ubuntu1.1 or later.