WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin Backup and Staging by WP Time Capsule versions = 1.22.21...

CVE-2024-48020

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through = 1.22.21...

CVE-2024-48020 WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through = 1.22.21...

CVE-2024-48020

CVE-2024-48020 : SQL Injection in Revmakx Backup and Staging by WP Time Capsule (plugin) up to version 1.22.21. Root cause: improper neutralization of input in SQL commands. Impact: high risk of data exposure/alteration via network access (CVSS v3.1 base 8.5). Affected: Backup and Staging by WP T...

CVE-2024-48020 WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through = 1.22.21...

PT-2024-32937 · Wp Time Capsule · Revmakx Backup/Staging

Name of the Vulnerable Software and Affected Versions: Revmakx Backup and Staging by WP Time Capsule versions 1.22.21 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

WordPress plugin Backup and Staging by WP Time Capsule SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin Backup and Staging by WP Time Capsule versions = 1.22.21...

WordPress Backup and Staging by WP Time Capsule Plugin <= 1.22.21 is vulnerable to SQL Injection

Software Backup and Staging by WP Time Capsule Type Plugin Vulnerable versions = 1.22.21 Fixed in 1.22.22 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-48020 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 257cfd27ce2c Credits Hakiduck Required...

GO-2024-3077 Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule...

GO-2022-1135 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule

Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule...

GO-2022-0329 Improper Authentication in Capsule Proxy in github.com/clastix/capsule-proxy

Improper Authentication in Capsule Proxy in github.com/clastix/capsule-proxy...

GO-2023-2351 Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy

Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy...

Incorrect Authorization

github.com/projectcapsule/capsule is vulnerable to Incorrect Authorization. The vulnerability is caused due to the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant i.e., namespaces without the ownerReference field. This can lead to an attacker gaining contro...

Capsule tenant owner with "patch namespace" permission can hijack system namespaces

Attack Vector Then, let me briefly explain the reasons for the errors mentioned above: 1. The 'kubectl edit' command was used to patch the namespace, but this operation requires both 'get' and 'patch' permissions, hence the error. One should use methods like 'curl' to directly send a PATCH reques...

CVE-2024-39690

Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant i.e., namespaces without the ownerReference field, thereby gaining control of that namespace. Version...

CVE-2024-39690

Summary: CVE-2024-39690 affects Capsule (Kubernetes multi-tenant framework) and describes an authorization bypass where a tenant-owner with the ability to patch a namespace can hijack system namespaces (kube-system, default, capsule-system) if the namespace has not been taken over by a tenant. In...

CVE-2024-39690 Capsule tenant owner with "patch namespace" permission can hijack system namespaces

Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant i.e., namespaces without the ownerReference field, thereby gaining control of that namespace. Version...

CVE-2024-39690 Capsule tenant owner with "patch namespace" permission can hijack system namespaces

Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant i.e., namespaces without the ownerReference field, thereby gaining control of that namespace. Version...

Capsule 安全漏洞

Capsule is a multi-tenant and policy-based framework for Kubernetes open-sourced by Project Capsule. A security vulnerability exists in Capsule version v0.7.0, which stems from the ability of a tenant owner to patch any arbitrary namespace that has not been taken over by the tenant, and thus gain...