The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

Impact The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespac...

PT-2024-30671 · Unknown +1 · Baremetal Operator +2

Name of the Vulnerable Software and Affected Versions: baremetal-operator versions prior to 0.8.0 baremetal-operator versions prior to 0.6.2 baremetal-operator versions prior to 0.5.2 Description: The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The...

MAL-2024-8373 Malicious code in @diotoborg/ipsa-magni-debitis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dd2fe1ad636ad48e60e63682fb9cd8500630f7254400236df9ded9104afbc03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8491 Malicious code in @diotoborg/odio-architecto-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 242e04cb7795a593bc209c4272c33abdcdc2ad9b903f569de9d57c019e6eef9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8582 Malicious code in @diotoborg/quod-voluptatibus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9861e3b676c38749e1da1a41ecbfd64d5f6b70cb4455cb86dba9e2148ea9ee4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8265 Malicious code in @diotoborg/dolorum-unde (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddf262e0132df270971a1172fba3fbefd9e87973c91142ea50d208ec475f7bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cilium 安全漏洞

Cilium is an open source software from Cilium Open Source. It is used to provide and transparently secure network connectivity and load balancing between application workloads, such as application containers or processes. A security vulnerability exists in Cilium versions 1.15.0 through prior to...

MAL-2024-7968 Malicious code in kiwoeslw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bae85e2f36251f9936fb3b965298a113bd8e3f92666f152e5882d69c935545bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Studio 42 elFinder vulnerable to Incorrect Access Control

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

PT-2024-29277 · Unknown · Woodpecker

Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 2.7.0 Description: The server allows any user to create and trigger malicious workflows, potentially leading to a host takeover or extraction of secrets normally provided to plugins. This issue can be exploited...

MAL-2024-7713 Malicious code in komcax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62c911bd41972a2fa3147e74bc8e6a7905d586c2f095b8190453f09f9250c613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7720 Malicious code in stylesshert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5cac694a4e67bb70870e3509a7d3944cb0cac1bad16defa2f01f1710d070b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7721 Malicious code in stylishteks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40a8ed6d750df7841026d152bf8840677964a636c2377940003db377ae525481 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7461 Malicious code in ngentot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58fbaedf7b05410b2599b41128462eff610f2872fdb8249f71c6f7098cd174b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7463 Malicious code in pempers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e84fd41469e0d0e3a2aaa287b34bb91d95fc28a2c59c47a6cd0aff32881df06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7306 Malicious code in @zitterorg/numquam-itaque (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60e579c813327d8135c8bd1d872c5a4b3365b45ba47e6a1e6d658939d9061b43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7355 Malicious code in @zitterorg/quisquam-distinctio-veritatis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b58d716ac87753ce385de5e4fe92c7cc14d9678b8b3effdfb1b2366e06073cd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...