Lucene search
+L

4921 matches found

Veracode
Veracode
added 2022/12/05 5:43 a.m.22 views

Privilege Escalation

github.com/clastix/capsule is vulnerable to privilege escalation. The vulnerability exists in the syncNamespaceMetadata function in namespaces.go because it can edit and remove the owner reference when granted patch capabilities on its namespace...

8.8CVSS8.3AI score0.00861EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2022/12/02 6:22 p.m.42 views

CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule...

8.8CVSS8.9AI score0.00861EPSS
SaveExploits0References4
CVE
CVE
added 2022/12/02 6:22 p.m.77 views

CVE-2022-46167

CVE-2022-46167 affects Capsule (Kubernetes multi-tenant/policy framework). Before v0.1.3, a ServiceAccount in a Tenant Namespace granted PATCH on its own Namespace can edit/delete the OwnerReference, breaking Capsule Operator reconciliation and removing Pod Security annotations, Network Policies,...

8.8CVSS8.6AI score0.00861EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2022/12/02 6:22 p.m.7 views

CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule...

8.8CVSS8.6AI score0.00861EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2022/12/02 12:0 a.m.18 views

PT-2022-27782 · Capsule · Capsule

Name of the Vulnerable Software and Affected Versions: Capsule versions prior to 0.1.3 Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it...

8.8CVSS7.1AI score0.00861EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2022/12/01 12:0 a.m.5 views

PT-2024-11835 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the sk user ns function, which is caused by the newly allocated skb not having sk in the unix diag get exact function. This can le...

9.1CVSS6.6AI score0.03849EPSS
SaveExploits13References1810
Oracle linux
Oracle linux
added 2022/11/22 12:0 a.m.45 views

libvirt security, bug fix, and enhancement update

8.5.0-7.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 8.5.0-7 - securityselinux: Dont ignore NVMe disks when setting image label rhbz2121441 8.5.0-6 - qemuprocess: Destroy domains namespace after killing QEMU rhbz2121141 8.5.0-5 - rpc: Pass OPENSSLCONF through to ssh invocations...

4.3CVSS0.6AI score0.01049EPSS
SaveExploits0
Veracode
Veracode
added 2022/11/16 8:35 p.m.34 views

Privilege Escalation

python3.10 is vulnerable to privilege escalation. The vulnerability exists when used with the forkserver start method on Linux allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine which...

7.8CVSS7.8AI score0.0063EPSS
SaveExploits0References23Affected Software5
NVD
NVD
added 2022/11/15 1:15 a.m.29 views

CVE-2022-42120

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' namespace attribute...

9.8CVSS0.00729EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/11/15 1:15 a.m.5 views

CVE-2022-42120

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' namespace attribute...

9.8CVSS7.5AI score0.00729EPSS
SaveExploits0References4
Prion
Prion
added 2022/11/15 1:15 a.m.32 views

Sql injection

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' namespace attribute...

7.5CVSS9.8AI score0.00729EPSS
SaveExploits0References3Affected Software2
Tenable Nessus
Tenable Nessus
added 2022/11/15 12:0 a.m.41 views

NewStart CGSL MAIN 6.02 : docker-ce Vulnerability (NS-SA-2022-0095)

The remote NewStart CGSL host, running version MAIN 6.02, has docker-ce packages installed that are affected by a vulnerability: - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for...

6CVSS7.5AI score0.01677EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2022/11/15 12:0 a.m.8 views

PT-2022-26266 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3 through 7.4.3.16 Liferay DXP versions 7.3 before update 4 Liferay DXP versions 7.4 before update 17 Description: A SQL injection issue in the Fragment module allows attackers to execute arbitrary SQL commands via...

9.8CVSS9.8AI score0.00729EPSS
SaveExploits0References11
Tenable Nessus
Tenable Nessus
added 2022/11/14 12:0 a.m.34 views

AlmaLinux 8 : mingw-expat (ALSA-2022:7811)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7811 advisory. - Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks...

9.8CVSS7.4AI score0.35867EPSS
SaveExploits1References7
CNNVD
CNNVD
added 2022/11/14 12:0 a.m.8 views

Liferay Portal和Liferay DXP SQL注入漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

9.8CVSS8.9AI score0.00729EPSS
SaveExploits0References5
OSV
OSV
added 2022/11/11 11:4 a.m.6 views

OESA-2022-2097 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

7.8CVSS9AI score0.0063EPSS
SaveExploits0References2
OSV
OSV
added 2022/11/11 11:4 a.m.5 views

OESA-2022-2057 expat security update

This package provides with static libraries and header files for developing with expat. Security Fixes: xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.CVE-2022-25235 xmlparse.c in Exp...

9.8CVSS8.9AI score0.35867EPSS
SaveExploits1References6
NVD
NVD
added 2022/11/10 6:15 a.m.26 views

CVE-2022-3866

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2...

5CVSS0.00508EPSS
SaveExploits0References1
OSV
OSV
added 2022/11/10 6:15 a.m.7 views

UBUNTU-CVE-2022-3866

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2...

5CVSS5.7AI score0.00508EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2022/11/10 5:34 a.m.81 views

CVE-2022-3866

Removed by vendor...

5CVSS5AI score0.00508EPSS
SaveExploits0
Rows per page
Query Builder