61858 matches found
CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation
A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...
GHSA-W32M-9786-JP63 vulnerabilities
Vulnerabilities for packages: kargo, flux-helm-controller, secrets-store-csi-driver-provider-azure, timoni, policy-controller, crossplane, grafana-operator, k9s, docker-compose, rabbitmq-cluster-operator, boring-registry, gcsfuse, nats, lvm-driver, flux-source-controller, conftest, fulcio,...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Operator package issues.. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for...
CVE-2024-42407
Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...
CVE-2024-42407
Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...
CVE-2024-42407: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...
PT-2024-29930
Name of the Vulnerable Software and Affected Versions Gallagher Command Centre Server versions 8.80 and prior Gallagher Command Centre Server versions 8.90 through 8.90.2356 Gallagher Command Centre Server versions 9.00 through 9.00.2374 Gallagher Command Centre Server versions 9.10 through...
GHSA-V778-237X-GJRC vulnerabilities
Vulnerabilities for packages: kargo, crossplane-provider-aws-cloudformation, flux-helm-controller, dagdotdev, aactl, secrets-store-csi-driver-provider-azure, kubernetes-dashboard-auth, ollama, openbao-k8s, tkn, policy-controller, seaweedfs, crossplane, local-path-provisioner, syft, dockerize, k9s...
Moderate: Red Hat Security Advisory: Cost Management Metrics Operator Update
Cost Management Metrics Operator version 3.3.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...
NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host.
...
CVE-2024-42457
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...
CVE-2024-42457
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...
CVE-2024-42457
CVE-2024-42457 concerns Veeam Backup & Replication. Reported vulnerabilities allow users with limited operator roles to expose saved credentials via the product’s remote management interface, by abusing a session object that enables credential enumeration and exploitation. The attack is facilitat...
GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...
Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.2 for RHEL 9
Kube Descheduler Operator for Red Hat OpenShift 5.0.2 for RHEL 9 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
SUSE CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
PT-2024-39240 · Axis · Axis Os
Name of the Vulnerable Software and Affected Versions: AXIS OS versions prior to the patched version Description: The VAPIX API managedoverlayimages.cgi is vulnerable to a race condition attack, allowing an attacker to block access to the overlay configuration page in the web interface of the Axi...
PT-2024-35970
Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...
CVE-2024-8772: Improper Validation of Syntactic Correctness of Input
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited...
