CVE-2023-43309

There is a stored cross-site scripting XSS vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload...

Webmin Cross-Site Scripting Vulnerability

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin 2.002 and prior versions that stems from a stored cross-site scripting XSS vulnerability in the Input field of the Cluster Cron Job...

PT-2023-9415 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin versions 2.002 and below Description: The issue is related to a stored cross-site scripting XSS vulnerability, which allows attackers to run malicious scripts by injecting a specially crafted payload via the Cluster Cron Job tab Input...

Moderate: Red Hat Security Advisory: [impact]: OpenShift Container Platform 4.13.13 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in pathname restrictions for directories, allows attackers to gain unauthorized access to protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to shortcomings in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Authentication flaw

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without...

Citrix Endpoint Management (aka XenMobile Server) 10.15.0 Rolling Patch 4

Package name: xms10.15.0.10417.bin For: XenMobile Server 10.15.0 Deployment type: On-premises only Replaces: xms10.15.0.10327.bin, xms10.15.0.10220.bin and xms10.15.0.10125.bin Date: September 2023 Languages supported: English US Important notes about this update As a best practice, Citrix...

CVE-2023-4958

In Red Hat Advanced Cluster Security RHACS, it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptivel...

September 12, 2023—KB5030287 (Security-only update)

None None...

PT-2023-9200 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free vulnerability in the f2fs read multi pages function. When f2fs decompress cluster is called and a cached page is hit in compress inode's cache,...

Argo CD cluster secret might leak in cluster details page

Impact Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and...

GHSA-FWR2-64VR-XV9M Argo CD cluster secret might leak in cluster details page

Impact Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and...

CVE-2023-40029

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

Design/Logic Flaw

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

CVE-2023-40029

Argo CD CVE-2023-40029 exploits leakage of full cluster secret bodies via kubectl.kubernetes.io/last-applied-configuration in cluster secrets. Affected by PR #7139; exposure occurs when clusters are stored as secrets and viewed through the API with clusters, get RBAC. Patches available in 2.8.3, ...

CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

CVE-2023-40029

A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the kubectl apply functionality, resulting in the full secret body being stored in kubectl.kubernetes.io/last-applied-configuration annotation. Since ArgoCD has included t...

Oracle Linux 5 : rgmanager (ELSA-2009-1339)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1339 advisory. 2.0.52-1.0.1 - Update summary and description to be vendor neutral 2.0.52-1 - When vm.sh does a status check and gets 'no state' it is now treated as a running...