283 matches found
kubebot
Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...
harbor
Presentazione del team Chongqing Jiugongge Security Team si dedica alla condivisione di strumenti di sicurezza open-source, coprendo molteplici aree di ricerca come Red & Blue Team, Sicurezza Web, Sicurezza Mobile, Sviluppo Sicuro, Sicurezza Aziendale, IoT/Sicurezza Industriale/AI/Sicurezza...
CVE-2024-23653
syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. + Building 5.3s 6/6 FINISHED...
CVE-2022-46463
CVE-2022-46463 CVE-2022-46463POC Harbor nicht autorisiert Details zur Sicherheitslücke siehe Stack Community Verwendung python3 cvve-2022-46463.py -u https://127.0.0.1:5003 Optionen -u URL, --url URL Ziel-URL z.B. http://example.com -h, --help Hilfemeldung anzeigen und beenden Direkt den Befehl...
CVE-2026-103667
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
CVE-2026-103667 Gitea container registry stored XSS through blob media type
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
EUVD-2026-93910
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
CVE-2026-103667 Gitea container registry stored XSS through blob media type
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
CVE-2026-103667
The Gitea container registry is vulnerable to a stored XSS flaw because it serves blob downloads using a Content-Type derived directly from the media type in pushed image manifests. Due to the lack of a Content-Disposition header or a restrictive content security policy, an attacker with push pri...
CVE-2026-103667 Gitea container registry stored XSS through blob media type
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
CVE-2019-16097
CVE-2019-16097 Principio della vulnerabilità di creazione non autorizzata di amministratore in Harbor, docker e poc basato su pocsuite framework...
PT-2026-107171
Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...
CVE-2026-93317
A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative OCI blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent...
CVE-2026-105163
A flaw was found in crossplane-runtime. A malicious container registry can bypass package signature verification when packages are installed using tag references instead of fixed content digests. Because the package manager resolves the image tag separately during verification and retrieval, an...
automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
CVE-2026-84703
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
CVE-2026-88887
A flaw was found in Renovate, a dependency update automation tool. When Renovate lists tags or digests for a container image, it follows pagination links provided by the remote registry in the HTTP Link header. However, it fails to verify that the pagination URL has the same origin as the origina...