1577 matches found
CVE-2023-2431 Bypass of seccomp profile enforcement
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined seccomp...
Code injection
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity validate.podSecurity subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4...
kyverno seccomp control can be circumvented
Impact Users of the podSecurity validate.podSecurity subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the...
PT-2023-24208 · Kyverno · Kyverno
Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.9.2 through 1.9.3 Description: Kyverno is a policy engine designed for Kubernetes. The issue concerns the Kyverno seccomp control, which can be circumvented. Users of the podSecurity validate.podSecurity subrule are affecte...
PT-2023-8928 · Fluid · Fluid
Name of the Vulnerable Software and Affected Versions: Fluid versions 0.7.0 through 0.8.5 Description: The issue is related to improper authorization in Fluid, an open-source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. If a malicious user...
[SECURITY] Fedora 38 Update: podman-4.4.4-3.fc38
podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...
podlozka-pod-spz.cz Cross Site Scripting vulnerability OBB-3259590
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Denial Of Service (DoS)
github.com/42atomys/stud42 is vulnerable to Denial of Service DoS. The vulnerability exits due to the graphQL parser which has the potential to overload the API pod because it does not check for a max content length, resulting in an attacker crashing the application...
CVE-2023-1260
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...
Red Hat OpenShift security vulnerabilities
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. Red Hat openshift has a security vulnerability that stems from the presence of an authentication bypass vulnerability, which could be...
Code injection
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to /opt/cni/bin due to a hostPath mount of that directory in the agent pod. By replacing the CNI binary...
CVE-2023-27593
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to "/opt/cni/bin" due to a "hostPath" mount of that directory in the agent pod. By replacing the CNI...
From Pod Security Policies to Pod Security Standards – a Migration Guide
Pod Security Policies were removed in Kubernetes v1.25 — learn how to migrate from Pod Security Policies to Pod Security Standards...
CVE-2023-0090
Proofpoint Enterprise Protection (PPS/POD) webservices are affected by CVE-2023-0090: an anonymous user can trigger remote code execution via eval injection, requiring network access to the webservices API (non-default configuration) and impacting all versions 8.20.0 and below. Exploitation detai...
CVE-2023-0089
CVE-2023-0089 affects Proofpoint Enterprise Protection (PPS/POD) webutils. An authenticated user can execute remote code through an eval injection vulnerability, impacting all versions ≤ 8.20.0. The issue arises in the webutils component of PPS/POD, enabling high-severity impact (C, I, A: High) a...
CVE-2022-2837
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains TLD to a pod they control by creating projects and namespaces that match the TLD...
CVE-2022-2837
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains TLD to a pod they control by creating projects and namespaces that match the TLD...
CVE-2022-2837
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains TLD to a pod they control by creating projects and namespaces that match the TLD...
SUSE CVE-2015-7970
The p2mpodemergencysweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service CPU consumption and possibly reboot via crafted memory contents that triggers a "time-consuming linear scan,"...