CVE-2025-47282: Improper Input Validation

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user...

CVE-2025-47284: Improper Neutralization of Escape, Meta, or Control Sequences

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the gardenlet component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a...

CVE-2025-47283: Improper Input Validation

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges for a Gardener project to obtain...

SUSE CVE-2024-9779

A flaw was found in Open Cluster Management OCM when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named...

GHSA-JHH6-6FHP-Q2XP Open Cluster Management vulnerable to Trust Boundary Violation

A flaw was found in Open Cluster Management OCM when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named...

CVE-2024-41628

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API...

CVE-2024-41628

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API...

CVE-2024-41628

A Directory Traversal vulnerability exists in Severalnines Cluster Control versions 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780. The flaw is located in the CMON API , specifically affecting the RPC and RPC-TLS user interfaces, which typically reside on ports 9500...

CVE-2024-41628: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API...

CVE-2024-41628

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API...

Severalnines Cluster Control 安全漏洞

Severalnines Cluster Control is agentless management and automation software for database clusters from Severalnines. Severalnines Cluster Control versions 1.9.8 prior to 1.9.8-9778, 2.0.0 prior to 2.0.0-9779, and 2.1.0 prior to 2.1.0-9780 have a security vulnerability that originates from the...

PT-2024-29470 · Severalnines · Severalnines Clustercontrol

Name of the Vulnerable Software and Affected Versions: Severalnines Cluster Control versions 1.9.8 through 1.9.8-9777 Severalnines Cluster Control versions 2.0.0 through 2.0.0-9778 Severalnines Cluster Control versions 2.1.0 through 2.1.0-9779 Description: A Directory Traversal issue allows a...

PT-2024-3523

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service Confidential Container affected versions not specified Description: The issue is related to a lack of access control in the deployment and management of confidential containers in Azure Kubernetes Service,...

SUSE CVE-2022-2735

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw...

Improper configuration of RBAC permissions obtaining cluster control permissions

Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. Details detail's is disable by publish. PoC detail's is disable by...

GHSA-74J8-W7F9-PP62 Improper configuration of RBAC permissions obtaining cluster control permissions

Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. Details detail's is disable by publish. PoC detail's is disable by...

CVE-2023-33190

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control RBAC permissions resulted in an attacker being able to obtain cluster control permissions, which could contr...

CVE-2023-33190 Improperly configured permissions in Sealos

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control RBAC permissions resulted in an attacker being able to obtain cluster control permissions, which could contr...

Sealos 授权问题漏洞

Sealos is a cloud operating system designed for managing cloud-native applications. An authorization issue vulnerability exists in Sealos versions prior to 4.2.0, which stems from a misconfiguration of Role-Based Access Control RBAC permissions, allowing an attacker to gain access to cluster...

CVE-2023-33190: Improper Authentication

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control RBAC permissions resulted in an attacker being able to obtain cluster control permissions, which could contr...