karmada-operator karmadactl Arbitrary File Write

The vulnerability of the karmada-operator and karmadactl packages from the Kubernetes cluster management system, which are used to run cloud applications across multiple Karmada clusters, is related to an incorrect path name limitation for accessing the restricted directory. Exploiting this...

CVE-2017-13322: Operator Precedence Logic Error

In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error in the code. This could lead to a local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Important: Red Hat Security Advisory: VolSync 0.10.2 for RHEL 9

VolSync v0.10.2 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9

VolSync v0.11.1 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

operator-sdk-1.39.0-1.1 on GA media (moderate)

operator-sdk-1.39.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14634-1 Rating: moderate Cross-References: CVE-2024-45338 CVE-2025-21614 CVSS scores: CVE-2024-45338 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-45338 SUSE : 8.2...

OPENSUSE-SU-2025:14634-1 operator-sdk-1.39.0-1.1 on GA media

These are all security issues fixed in the operator-sdk-1.39.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

PT-2025-4309

Name of the Vulnerable Software and Affected Versions Chatwoot versions prior to 3.16.0 Description The issue concerns a lack of input sanitization for the query operator in conversation and contact filters endpoints. This allows any authenticated actor to run arbitrary SQL within the filter quer...

CVE-2024-56514

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2024-56514: Improper Limitation of a Pathname to a Restricted Directory

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

GHSA-Q2X7-8RV6-6Q7H vulnerabilities

Vulnerabilities for packages: localstack, py3-jinja2, airflow, kubeflow-volumes-web-app, mlflow, superset, emissary, apache-beam-python-3.11-sdk, kubeflow-pipelines-visualization-server, ansible-operator, nemo, kserve, reflex, dask-gateway, kubeflow-jupyter-web-app, checkov...

GHSA-GMJ6-6F8F-6699 vulnerabilities

Vulnerabilities for packages: localstack, py3-jinja2, airflow, kubeflow-volumes-web-app, mlflow, superset, emissary, apache-beam-python-3.11-sdk, ansible-operator, nemo, kserve, reflex, dask-gateway, kubeflow-jupyter-web-app, checkov...

CVE-2024-56201 vulnerabilities

Vulnerabilities for packages: localstack, py3-jinja2, airflow, kubeflow-volumes-web-app, mlflow, superset, emissary, apache-beam-python-3.11-sdk, ansible-operator, nemo, kserve, reflex, dask-gateway, kubeflow-jupyter-web-app, checkov...

SUSE CVE-2024-43803

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of th...

OPENSUSE-SU-2024:0413-1 Security update for python-python-sql

This update for python-python-sql fixes the following issues: - CVE-2024-9774: Fixed that unary operators does not escape non-Expression boo1234653...

GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...