CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 POC Minio는 멀티 클라우드 객체 스토리지 프레임워크입니다. RELEASE.2019-12-17T23-16-33Z부터 RELEASE.2023-03-20T20-16-18Z 이전까지의 클러스터 배포에서 MinIO는 MINIOSECRETKEY 및 MINIOROOTPASSWORD를 포함한 모든 환경 변수를 반환하여 정보 노출을 초래합니다. 분산 배포의 모든 사용자가 영향을 받습니다. 모든 사용자는 RELEASE.2023-03-20T20-16-18Z로 업그레이드하는 것이 좋습니다...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

Kubernetes-1.12.3-all-auto-install

Kubernetes-1.12.3-all-auto-install 프로젝트 소개 개인이 정리한 Centos7.x + Kubernetes-1.12.3 + Dashboard-1.8.3, CVE-2018-1002105 취약점이 없는 master, node 노드의 완전 자동 빠른 원클릭 설치 배포 파일입니다. 테스트 환경 및 프로덕션 환경의 빠른 설치 배포에 적합합니다. 참고 문서 https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/ master 노드 설치 준비 1...

grafana-cve-2021-43798

grafana-cve-2021-43798 이 저장소에는 취약점을 재현하기 위한 파일이 포함되어 있습니다. 다음 명령을 사용하여 클러스터에 배포하십시오. kubectl apply -f grafana-vuln-app.yaml...

GO-2024-2617 vulnerabilities

Vulnerabilities for packages: k3d...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.3

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.10.3 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.10.3 release that simplify the process of...

EUVD-2026-30331

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to th...

GHSA-V8J7-HP7C-738F Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

Summary Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. Thi...

CVE-2023-28432

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due interaction between unexpected parameter values set for ClusterDeployment.hive.openshift.io/v1 and ClusterSync.hiveinternal.openshift.io/v1alpha1 objects in the Reconcile method i...

CVE-2022-45157 Exposure of vSphere's CPI and CSI credentials in Rancher

A vulnerability has been identified in the way that Rancher stores vSphere's CPI Cloud Provider Interface and CSI Container Storage Interface credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext...

OpenDaylight 安全漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight Model-Driven Service Abstraction Layer MD-SAL version 13.0.1 and earlier, which stems from the fact that controllers with the follower role can configure flow entries i...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.1 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.1 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2024-20283

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries t...

CVE-2024-20283

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries t...

CVE-2024-20283

Cisco Nexus Dashboard contains an information-disclosure vulnerability (CVE-2024-20283) due to improper access controls on a specific API endpoint. An authenticated remote attacker could query the API to access metrics and deployment information for devices within the Nexus Dashboard cluster. The...

Metasploit Wrap-Up 03/15/2024

New module content 3 GitLab Password Reset Account Takeover Authors: asterion04 and h00die Type: Auxiliary Pull request: 18716 contributed by h00die Path: admin/http/gitlabpasswordresetaccounttakeover AttackerKB reference: CVE-2023-7028 Description: This adds an exploit module that leverages an...

BIT-MINIO-2023-28432 Minio Information Disclosure in Cluster Deployment

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

MinIO Information Disclosure Vulnerability

MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure...

Information Exposure

github.com/minio/minio-go, is vulnerable to Sensitive Information Exposure. The vulnerability exists during cluster deployment due to a lack of sensitive environment variable masking in the MINIOSECRETKEY and MINIOROOTPASSWORD, allowing an attacker to exfiltrate sensitive tokens from the system...