PT-2024-27057 · Unknown · Cert-Manager

Name of the Vulnerable Software and Affected Versions: cert-manager version 1.14.4 Description: The issue is related to insecure permissions, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For cert-manager version...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

CVE-2024-36538 affects Chaos Mesh (v2.6.3 and earlier). The issue stems from insecure permissions that allow an attacker to access a service account token, enabling data access and privilege escalation. The Red Hat, NVD, OSV, CNNVD, CVE listing all describe the same flaw, with a base CVSS v3.1 sc...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36534

Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36534

CVE-2024-36534 affects hwameistor v0.14.3 and earlier, with insecure permissions allowing an attacker to access sensitive data and escalate privileges by obtaining a service account token. The issue stems from misconfigured permissions that permit token access and privilege elevation within the s...

CVE-2024-36535

CVE-2024-36535 affects meshery v0.7.51 and earlier, with insecure permissions that allow an attacker to access the service account token, enabling data access and privilege escalation. Multiple sources (Red Hat, Veracode, OSV, NVD, CNNVD, CVE list, PT-2024-27055) corroborate this description. The...

CVE-2024-36535

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36535

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27061 · Unknown · External-Secrets

Name of the Vulnerable Software and Affected Versions: external-secrets version 0.9.16 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For external-secrets version 0.9.1...

CVE-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36533

Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36534

Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

The CVE refers to CVE-2024-36540 affecting external-secrets v0.9.16, where insecure permissions in the service account token handling allow an attacker to access sensitive data and escalate privileges. The issue is described across multiple feeds as a root-cause of insecure permissions enabling t...

CVE-2024-36537

CVE-2024-36537 : cert-manager v1.14.4 contains an insecure permissions flaw that allows an attacker to access the service account token and escalate privileges, per NVD/Red Hat/IBM notes. Root cause is improper access control on credentials, enabling exposure of sensitive data. The connected advi...