239 matches found
silicon2022-capturetheflag
silicon2022-ctf 关于 这是一个包含 41 个 flag 的 CTF，使用 RootTheBox 平台搭建。基础设施（大部分）部署在 Azure Kubernetes Service 上。终端挑战通过使用修改版 WeTTY 的 Docker 镜像进行部署。 构建 大多数 挑战都是以 Docker 镜像的形式构建的。你可以进入相应的挑战目录，构建 Dockerfile 来启动你自己的实例，或查看 README 获取其他说明。 解决方案 你可以在每个挑战对应的解决方案文件夹中找到相应的解答。 贡献者 今年的 CTF 由以下人员构建 paill dhasek00 GO0dspee...
CVE-2026-75889 CVE-2026-75889 CVE Record
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...
CVE-2026-62440
CVE-2026-62440 is an Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin . It allows cross-tenant manipulation of a Kubernetes cluster during node add/remove operations, meaning one tenant can affect another tenant's cluster. Affected versions are 4.21.0.0...
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-50516
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50516 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
...
CVE-2026-50516 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
...
CVE-2026-50516
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-56778
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
PT-2026-70387
Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
MAL-2026-11558 Malicious code in @cacheable/memory (npm)
npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...
EUVD-2026-51093
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
CVE-2026-56163
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-56163
The vulnerability CVE-2026-56163 affects Microsoft Azure Kubernetes Service. It arises from missing authentication for a critical function, enabling an unauthenticated attacker to achieve network-based elevation of privilege within the service. The reported impact is high for confidentiality, int...
CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
...
CVE-2026-56163
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...