Information disclosure

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim PVC in the source namespace. This could allow users to clone any PVC in...

CVE-2019-10175

The vulnerability CVE-2019-10175 affects containerized-data-importer (virt-cdi-cloner) 1.4 where host-assisted cloning does not verify if the requesting user has permission to access a PVC in the source namespace. This can allow cloning any PVC in the cluster into the user’s namespace, effectivel...

CVE-2019-10175

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim PVC in the source namespace. This could allow users to clone any PVC in...

CVE-2019-10175: Improper Access Control

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim PVC in the source namespace. This could allow users to clone any PVC in...

The vulnerability of the data import service virt-cdi-importer in the Kubevirt virtualization tool allows a attacker to execute a “man-in-the-middle” attack.

The vulnerability of the virt-cdi-importer data import service in the Kubevirt virtualization tool is related to improper verification of certificate authenticity. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

Input validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0–1.5.3, were reported to disable TLS certificate validation when importing data into PVCs from container registries, enabling potential man-in-the-middle attacks that could tamper with trusted container image content. The affected component is the virt-cd...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841: Improper Certificate Validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

cdi.mecon.gob.ar XSS vulnerability

Vulnerable URL: http://cdi.mecon.gob.ar/greenstone/cgi-bin/library.cgi?site=localhost=p=about=confere1=es=%22%3E%3Csvg%2Fonload%3Dalert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.01.2018 Vulnerability type:| XSS Vulnerability status:| Public...