Open Cluster Management 安全漏洞

Open Cluster Management OCM is a community-driven project of Open Cluster Management open source. Focused on multi-cluster and multi-cloud scenarios for Kubernetes applications. A security vulnerability exists in Open Cluster Management that stems from a vulnerability found in Open Cluster...

CVE-2024-42018

An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration...

Red Hat OpenShift Container Platform 安全漏洞

Red Hat OpenShift Container Platform is a suite of application platforms from Red Hat, Inc. that help organizations develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A security vulnerability exists in Red Hat OpenShift...

DRUPAL-CONTRIB-2024-030

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hook\ENTITY\TYPE\access hooks meaning the titles of restricted...

Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hookENTITYTYPEaccess hooks meaning the titles of restricted nod...

Kanister 安全漏洞

Kanister is a data protection workflow management tool from Kanister Open Source. A security vulnerability exists in Kanister that stems from a cluster-level privilege elevation that can be performed by a malicious user by accessing a worker node...

PT-2024-23572 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: A issue was discovered that allows remote attackers to cause a denial of service DoS in the ROS2 nodes. Recommendations: For ROS2 Galactic Geochelone versio...

PT-2024-23549 · Unknown · Ros Melodic Morenia

Name of the Vulnerable Software and Affected Versions: ROS Melodic Morenia versions where ROS VERSION is 1 and ROS PYTHON VERSION is 3 Description: An unauthorized access issue has been discovered, potentially allowing a malicious user to gain unauthorized information access to multiple ROS nodes...

PT-2024-10098 · Drupal · Node Access Rebuild Progressive

Name of the Vulnerable Software and Affected Versions: Node Access Rebuild Progressive versions 7.X-1.0 through 7.X-1.2 Description: The issue is related to improper ownership management in Node Access Rebuild Progressive, allowing target influence via framing. This can be exploited by a remote...

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled...

PT-2024-10354 · Drupal · Node Access Rebuild Progressive

Name of the Vulnerable Software and Affected Versions: Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication. Description: The issue is related to improper...

ADM DR Node Only Accessible by Default Username/Password

The nsroot password that is configured on our Primary/Secondary ADM hosts did not appear to be replicated to the DR node. When accessing the DR node over the VSphere console we can only log into it with the default nsrecover/nsroot username/password. If I update the password for the nsroot and...

DRUPAL-CONTRIB-2023-018

This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when retrieving the label of an AddToAny block. This vulnerability is mitigated by the fact it requires the node ID to be passed via the route, requiring another module or specific...

CVE-2023-2250

A flaw was found in the Open Cluster Management OCM when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service...

AZL-34902 CVE-2023-26484 affecting package kubevirt for versions less than 1.2.0-1

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to...

xCAT 安全漏洞

xCAT is a toolset that provides complete management for HPC clusters, render farms, grids, web farms, online gaming infrastructures, clouds, and data centers. A security vulnerability exists in xCAT versions prior to 2.16.5, which stems from the fact that if a zone is configured for cluster...

DRUPAL-CONTRIB-2023-008

This module enables you to associate Forums as Group 1.x content and use Group access permissions. Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics...

Group control for forums - Critical - Access bypass - SA-CONTRIB-2023-008

This module enables you to associate Forums as Group 1.x content and use Group access permissions. Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics...

SUSE CVE-2017-6930

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

PT-2023-33776 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue concerns the RDMA/core component of the Linux Kernel, where the ib port is not properly validated when accessing a sysfs node. The actual impact and attack plausibility have not ye...