CVE-2023-3893 Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy...

PT-2023-27920 · Nokia · Chunghwa Telecom Nokia G-040W-Q

Name of the Vulnerable Software and Affected Versions: Chunghwa Telecom NOKIA G-040W-Q affected versions not specified Description: The issue is related to insufficient filtering for user input, allowing a remote attacker with administrator privilege to perform a Command Injection attack. This ca...

Privilege Escalation

Kubernetes is vulnerable to Privilege Escalation. The vulnerability is due to a lack of input sanitization on windows nodes which allows a user to escalate to admin privileges...

Privilege Escalation

Kubernetes is vulnerable to Privilege Escalation. The vulnerability allows allows a user with the ability to create pods on Windows nodes to escalate to admin privileges, which leads to privilege escalation...

PT-2023-6692 · Bitrix +1 · Bitrix24 +1

Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: A cross-site scripting XSS issue in the Invoice Edit Page of Bitrix24 allows attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also...

Kubernetes privilege escalation vulnerability

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

CVE-2023-3676

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

DEBIAN-CVE-2023-3955

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

Security feature bypass

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

CVE-2023-3955

CVE-2023-3955 (Kubernetes) describes a privilege-escalation issue: a user who can create pods on Windows nodes may escalate to admin privileges on those nodes. Affected scope is limited to clusters that include Windows nodes. The description does not provide specifics on exploit vectors, affected...

CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

CVE-2023-3676

CVE-2023-3676 affects Kubernetes clusters that include Windows nodes. A user who can create pods on Windows nodes may escalate to admin privileges on those nodes. This is described as an improper input validation issue (CWE-20) in the Kubernetes context. The provided connected documents do not sp...

CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

PT-2023-29900 · Unknown · Smart App Banner Plugin

Name of the Vulnerable Software and Affected Versions: Smart App Banner plugin versions 1.1.3 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts into the...

PT-2023-29841 · WordPress · Category Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin versions prior to 2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

Vulnerabilities fixed in SugarCRM

Vulnerabilities have been fixed in SugarCRM. A malicious party can exploit the vulnerabilities to conduct a Cross-Site Scripting attack. Such an attack can lead to execution of arbitrary code in the context of the victim's victim's browser, or access sensitive data in the context of the victim's...

CVE-2023-34056

vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data...

PT-2023-19883 · Printfriendly · Print

Name of the Vulnerable Software and Affected Versions: Print, PDF, Email by PrintFriendly plugin versions = 5.5.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Print, PDF, Email by PrintFriendly plugin. This vulnerability requires...

PT-2023-29621 · WordPress · Cpt Shortcode Generator

Name of the Vulnerable Software and Affected Versions: CPT Shortcode Generator plugin versions prior to 1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.1...

foreman: OS command injection via ct_command and fcct_command

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...