9358 matches found
Improper Access Control
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object...
PT-2016-1271 · Kubernetes · Kubernetes
Name of the Vulnerable Software and Affected Versions: Kubernetes affected versions not specified Description: The issue is related to insufficient access control in the Kubernetes API server, allowing remote authenticated users to access additional resources by crafting a patched object. This ca...
server: patch operation should use patched object to check admission control
An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space...
server: build config to a strategy that isn't allowed by policy
An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build-configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the buil...
Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1.1 bug fix and enhancement update
Red Hat OpenShift Enterprise release 3.1.1 is now available with updates to packages that fix several security issues, bugs and introduce feature enhancements. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...
Red Hat OpenShift Enterprise使用Google Kubernetes目录遍历漏洞
No description provided by source...
Red Hat OpenShift Enterprise using Google Kubernetes Directory Traversal Vulnerability
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that builds, tests, deploys, and runs applications from Red Hat, U.S.A. OpenShift Enterprise is an open source version of the private cloud.Google Kubernetes is a suite of Google's open source Docker container cluster...
CVE-2015-5305
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...
Directory traversal
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...
CVE-2015-5305
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...
CVE-2015-5305
CVE-2015-5305 describes a directory traversal in Kubernetes as used by Red Hat OpenShift Enterprise 3.0. An attacker can write to arbitrary files by supplying a crafted object type name that is not properly validated before being passed to etcd. The vulnerability affects Kubernetes/OpenShift comp...
CVE-2015-5305
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...
PT-2015-6842 · Red Hat +2 · Red Hat Openshift Enterprise +2
Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to the fixed version Red Hat OpenShift Enterprise version 3.0 Description: A directory traversal issue exists due to improper handling of crafted object type names before they are passed to etcd. This allows attacker...
Docker Remote API 未授权访问
介绍 docker 在使用集群管理如:Kubernetes,swarm时，要使用remote api对节点进行管理.remote api无认证时的默认端口是2375需要TLS认证默认登录是2376。 remote api默认是可以不需要认证能直接访问，能直接对docker进行操作,如新建容器,删除容器,查看镜像容器信息等... remote api操作方法见docker官方文档 检测docker remote api 未授权访问可以使用curl或者直接用浏览器访问 http://ip:2375/info 如果返回了json证明漏洞存在，如下图 其他参考链接...
Kubernetes: Missing name validation allows path traversal in etcd
Kubernetes fails to validate object name types before passing the data to etcd. As the etcd service generates keys based on the object name type this can lead to a directory path traversal...
Moderate: Red Hat Security Advisory: kubernetes security update
Updated kubernetes packages that fix one security issue are now available for Red Hat OpenShift Enterprise 3.0. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
