UBUNTU-CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

Authorization

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

DRUPAL-CONTRIB-2023-008

This module enables you to associate Forums as Group 1.x content and use Group access permissions. Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics...

Blackfly Chinese APT targets Asian conglomerate in materials sector

Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The Blackfly espionage group, also known as APT41, Winnti Group, or Bronze Atlas, has been targeting multiple subsidiaries of an Asian conglomerate operating in the...

CVE-2022-3162

The CVE-2022-3162 entry affects Kubernetes kube-apiserver, where an authenticated user with cluster-wide list/watch rights on one CustomResourceDefinition in an API group could read custom resources of another type in the same API group due to improper authorization. Impact is read access to othe...

CVE-2022-3162 Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

Group control for forums - Critical - Access bypass - SA-CONTRIB-2023-008

This module enables you to associate Forums as Group 1.x content and use Group access permissions. Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics...

CVE-2022-3162 Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2022-3162 Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

US Marshals Service Hit By Major Ransomware Attack

By Waqas At this moment, it is unclear which group is responsible for the ransomware attack. This is a post from HackRead.com Read the original post: US Marshals Service Hit By Major Ransomware Attack...

CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. Tracked as CVE-2022-36537 CVSS score: 7.5, the issue impacts ZK Framework versions...

TCG TPM2.0 implementations vulnerable to memory corruption

Overview Two buffer overflow vulnerabilities were discovered in the Trusted Platform Module TPM 2.0 reference library specification, currently at Level 00, Revision 01.59 November 2019. An attacker who has access to a TPM-command interface can send maliciously-crafted commands to the module and...

Intel® SGX Linux Kernel Drivers Advisory

Summary: A potential security vulnerability in Intel® SGX Linux kernel drivers may allow denial of service. Intel is working with the Linux kernel maintainers to create a mitigation. Vulnerability Details: CVEID: CVE-2021-33135 Description: Uncontrolled resource consumption in the Linux kernel...

TCG TPM 缓冲区错误漏洞

TCG TPM is a chip from the Trusted Computing Group that is planted inside a computer to provide a trusted root for the computer. A security vulnerability exists in version 2.0 of the TCG TPM that stems from an out-of-bounds write issue. An attacker could use this vulnerability to cause a denial o...

MAL-2023-6610 Malicious code in selfreplacetoolreplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5afa2837f01d52ea3608d81ca5f739c43e9b4707e5ff3f8219f51d2c27f3dc03 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5518 Malicious code in py-pushpingload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 92d3a1c30172ae30ec5af9afddc967e08214d997da4fc4619ec8ffd9bbd050f4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6651 Malicious code in selfstrresuper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 49803565eb7930c1be012ba3459247ea4b14d432a6e16c4ba5917e4e2f697856 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4138 Malicious code in libkilledgame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7309d7a56fe3f4d048da7ed2d69ea79e96435d3da3cd52434e2326c8ec184c1d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...