20639 matches found
CVE-2024-6840
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account...
CVE-2024-6840 Automation-controller: gain access to the k8s api server via job execution with container group
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account...
CVE-2024-6840 Automation-controller: gain access to the k8s api server via job execution with container group
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account...
Living off the land, GPO style
TL;DR The ability to edit Group Policy Object GPOs from non-domain joined computers using the native Group Policy editor has been on my list for a long time. This blog post takes a deep dive into what steps were taken to find out why domain joined machines are needed in the first place and what...
SUSE CVE-2024-45013
In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvmeuninitctrl Commit 4733b65d82bd "nvme: start keep-alive after admin queue setup" moves starting keep-alive from nvmestartctrl into nvmeinitctrlfinish, but don't move stopping keep-alive into...
CVE-2024-8694
A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is...
CVE-2024-20483
Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager Mongo...
CVE-2024-20489
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...
CVE-2024-20483
Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager Mongo...
CVE-2024-20489
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...
CVE-2024-20489 Cisco Routed Passive Optical Network Cleartext Password Vulnerability
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...
CVE-2024-20489
CVE-2024-20489 affects Cisco IOS XR Software running PON Controller, where the storage of unencrypted database credentials in the configuration files allows an authenticated, local attacker with low privileges to view MongoDB credentials. The root cause is improper storage of credentials on the d...
CVE-2024-20483 Cisco IOS XR PON Controller Command Injection Vulnerabilities
Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager Mongo...
CVE-2024-20483
CVE-2024-20483 involves multiple vulnerabilities in Cisco Routed PON Controller Software (Docker container on Cisco IOS XR hardware) where insufficient validation of arguments to configuration commands can allow an authenticated, admin-level attacker on the PON Manager or direct access to its Mon...
UBUNTU-CVE-2024-45013
In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvmeuninitctrl Commit 4733b65d82bd "nvme: start keep-alive after admin queue setup" moves starting keep-alive from nvmestartctrl into nvmeinitctrlfinish, but don't move stopping keep-alive into...
UBUNTU-CVE-2024-45027
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check for xhci-interrupters being allocated in xhcimemclearup If xhcimeminit fails, it calls into xhcimemcleanup to mop up the damage. If it fails early enough, before xhci-interrupters is allocated but after...
Cisco Routed Passive Optical Network Controller Vulnerabilities
Multiple vulnerabilities in Cisco Routed Passive Optical Network PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker to perform command injection attacks, execute arbitrary commands on the...
CVE-2024-45013 nvme: move stopping keep-alive into nvme_uninit_ctrl()
In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvmeuninitctrl Commit 4733b65d82bd "nvme: start keep-alive after admin queue setup" moves starting keep-alive from nvmestartctrl into nvmeinitctrlfinish, but don't move stopping keep-alive into...
CVE-2024-42486
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway...
