The vulnerability of the Rancher Manager software for managing Kubernetes clusters lies in the improper assignment of permissions to critical resources, allowing attackers to increase their privileges.

The vulnerability of the Rancher Manager software for managing Kubernetes clusters is related to the improper assignment of permissions to critical resources. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2024-56514

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2024-56513

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the karmadactl register command have excessive privileges to access control plane resources...

CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2024-56513 Karmada PULL Mode Cluster Privilege Escalation

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the karmadactl register command have excessive privileges to access control plane resources...

CVE-2024-56513 Karmada PULL Mode Cluster Privilege Escalation

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the karmadactl register command have excessive privileges to access control plane resources...

Moderate: Red Hat Bug Fix Advisory: Multicluster Engine for Kubernetes 2.5.5 bug fix updates

Multicluster Engine for Kubernetes 2.5.5 General Availability release images, which fix bugs and update container images. Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data...

CVE-2023-37916

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user including admin. A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users...

CVE-2023-37917 Privilege Escalation in kubepi

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

[SECURITY] Fedora 38 Update: golang-helm-3-3.11.1-1.fc38

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Use Helm to: - Find and use popular software packaged as Helm Charts to run in Kubernetes - Share your own applications as Helm Charts - Create reproducible builds of your Kubernetes applications -...

The vulnerability of the Kubernetes cluster management software, related to the use of open redirection, allows a hacker to access confidential data and compromise its integrity.

The vulnerability of the Kubernetes cluster management software relates to the use of open redirection. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and compromise its integrity...

The vulnerability of the YAML syntax analyzer library used in Kubernetes cluster management software allows a attacker to trigger a service failure.

The vulnerability of the YAML syntax analyzer library used in Kubernetes cluster management software exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...