Pods < 3.1 - Contributor+ Remote Code Execution

Description The plugin is vulnerable to Remote Code Execution via shortcode, allowing authenticated attackers, with contributor level access or higher, to execute code on the server...

WordPress Pods Plugin <= 3.0.10 is vulnerable to SQL Injection

Software Pods Type Plugin Vulnerable versions = 3.0.10 Fixed in 3.0.10.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-6967 Patch priority Low CVSS severity Low 8.5 Developer Pods Framework PSID ebff2ccf3db7 Credits Nex Team Required privilege Contributor Published 29 March...

PT-2024-9642

Name of the Vulnerable Software and Affected Versions Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00 Dell PowerFlex rack versions prior to RCM 3.8.1.0 and prior to RCM 3.7.6.0 Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0 Dell InsightIQ...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption between pods. The vulnerability is caused when external key-value store kvstore and Wireguard transparent encryption are enabled. If an attacker has access to the underlying cluster they can intercept sensitive traffic between pods,...

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

Code injection

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and...

CVE-2024-25631 Unencrypted traffic between pods when using Wireguard and an external kvstore

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and...

[SECURITY] Fedora 38 Update: prometheus-podman-exporter-1.7.0-1.fc38

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.7.0-1.fc39

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

Moderate: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: golang: crypto/tls: slow verification of certificate chains containing large RSA keys...

[SECURITY] Fedora 38 Update: prometheus-podman-exporter-1.5.0-1.fc38

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 37 Update: prometheus-podman-exporter-1.5.0-1.fc37

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

Fedora: Security Advisory (FEDORA-2023-b75ee820ce)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AZL-34894 CVE-2023-5528 affecting package kubernetes for versions less than 1.28.7-2

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes...

AZL-32005 CVE-2023-5528 affecting package kubernetes for versions less than 1.28.4-1

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes...

Kubernetes Security Vulnerabilities

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. Kubernetes has a security vulnerability that stems from the fact that users who can create Pods and persistent volumes on Window...

Moderate: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 net/http...

kube-apiserver: PrivEsc

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.3 security and bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.13.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS ba...

Authentication Bypass

apiserver-library-go s vulnerable to Authentication Bypass. The vulnerability is due to the computeSecurityContext function in admission.go not properly checking against all SCCs. This issue could allow a remote, authenticated attacker who has been given the "update, patch" permissions and the...