113 matches found
CVE-2021-25742
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster...
CVE-2021-25742
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster...
CVE-2021-25742
CVE-2021-25742 affects the Kubernetes NGINX Ingress Controller via the custom snippets feature. A user who can create or update ingress objects can exploit this flaw to obtain all secrets in the cluster (cross-namespace access). This is tied to ingress-nginx behavior rather than a generic service...
Kubernetes: Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
I submitted the following report to [email protected]: I've been exploring CVE-2021-25742 and believe I've discovered a variant although it appears there may be many. Most template variables are not escaped properly in nginx.tmpl, leading to injection of arbitrary nginx directives. For...
Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue has been rated High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, and assigned CVE-2021-25742...
Huawei EulerOS: Security Advisory for qemu-kvm (EulerOS-SA-2021-2046)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for qemu (EulerOS-SA-2021-1455)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-25742 affecting package qemu-kvm 4.2.0-48
CVE-2020-25742 affecting package qemu-kvm 4.2.0-48. A patched version of the package is available...
CVE-2020-25742
creationtimestamp| type| source ---|---|--- 2020-10-06 18:27:59+00:00| seen| https://t.me/cibsecurity/15083 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...
CVE-2020-25742
pcichangeirqlevel in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pcigetbus might not return a valid pointer...
CVE-2020-25742
pcichangeirqlevel in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pcigetbus might not return a valid pointer...
CVE-2020-25742
CVE-2020-25742 is a local-persistence vulnerability in QEMU's PCI subsystem. The NULL pointer dereference occurs in pci_change_irq_level (hw/pci/pci.c) when pci_get_bus() may return an invalid pointer, affecting QEMU versions before 5.1.1. Exploitation could crash or destabilize the QEMU process ...
