KubeView 访问控制错误漏洞

KubeView is a Kubernetes cluster visualizer and graphical viewer by Ben Coleman, an individual developer. An access control error vulnerability exists in versions of KubeView prior to 0.1.31, which stems from the fact that its api / scraper /kube-system does not require authentication and retriev...

CVE-2022-45933

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side projec...

CVE-2022-3920

A flaw was found in the Consul Package. Affected versions of this package are vulnerable to information exposure via the /v1/internal/ui/nodes and /v1/internal/ui/services endpoints for cluster peering, which expose node and service information to unauthenticated attackers...

Low: Red Hat Security Advisory: OpenShift Container Platform 4.11.16 security update

Red Hat OpenShift Container Platform release 4.11.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a...

Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries

Microsoft on Tuesday disclosed the intrusion activity aimed at Indian power grid entities earlier this year likely involved the exploitation of security flaws in a now-discontinued web server called Boa. The tech behemoth's cybersecurity division said the vulnerable component poses a "supply chai...

[SECURITY] Fedora 35 Update: kubernetes-1.22.16-1.fc35

Container cluster management...

Fedora: Security Advisory for kubernetes (FEDORA-2022-2004702d98)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

MariaDB 10.1.0 < 10.1.21 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.1.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.21 advisory. - mysqldsafe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.41 security update

Red Hat OpenShift Container Platform release 4.10.41 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

GHSA-W8WG-62WF-62GM Jenkins Cluster Statistics Plugin Missing Authorization vulnerability

Jenkins Cluster Statistics Plugin 0.4.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to delete recorded Jenkins Cluster Statistics. Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site...

GHSA-24HP-84JP-8WGM Cross-Site Request Forgery in Jenkins Cluster Statistics Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics...

Jenkins Cluster Statistics Plugin Missing Authorization vulnerability

Jenkins Cluster Statistics Plugin 0.4.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to delete recorded Jenkins Cluster Statistics. Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site...

Cross-Site Request Forgery in Jenkins Cluster Statistics Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics...

GHSA-GW2G-HHC9-WGJH Missing Authorization in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.6 / 2.361.3.4 Multiple Vulnerabilities (CloudBees Security Advisory 2022-11-15)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.6 or 2.x prior to 2.361.3.4. It is, therefore, affected by multiple vulnerabilities including the following: - CVE-2022-38751 on snakeyaml fixed train 2.346.x.0.z BEE-237...

CVE-2022-3920

Summary (CVE-2022-3920) HashiCorp Consul and Consul Enterprise versions 1.13.0–1.13.3 expose information via UI endpoints because cluster filtering does not filter imported nodes and services for HTTP or RPC endpoints. Root cause: inadequate filtering of cluster data used by the UI. Impact: poten...

CVE-2022-3920

Removed by vendor...

CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

Consul Cluster Peering Leaks Imported Nodes/Services Information

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that the /v1/internal/ui/nodes and /v1/internal/ui/services HTTP endpoints do not properly filter information by ACL policies. This vulnerability, CVE-2022-3920, was fixed in Consul 1.14.0. Background Consul...