Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

...

April 9, 2024—KB5036910 (OS Build 25398.830)

None None...

PT-2024-4666 · Microsoft · Azure Arc-Enabled Kubernetes Extension Cluster

Name of the Vulnerable Software and Affected Versions: Azure Arc-enabled Kubernetes Extension Cluster affected versions not specified Description: The issue is related to insufficient access controls in Azure Arc-enabled Kubernetes extensions, which can be exploited by a remote attacker to elevat...

PT-2024-3523

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service Confidential Container affected versions not specified Description: The issue is related to a lack of access control in the deployment and management of confidential containers in Azure Kubernetes Service,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.20 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.20 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

The vulnerability of the Elasticsearch search system’s Remote Cluster Security component, related to incorrect authentication, allows a perpetrator to gain access to protected information.

The vulnerability of the Elasticsearch search system component related to Remote Cluster Security is linked to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain access to protected information...

The vulnerability of distributed data sets orchestrators and open-source accelerators in Kubernetes for applications with intensive data processing, related to improper authorization, allows attackers to gain full privileged access to the entire cluster.

The vulnerability of distributed data sets orchestrators and open-source accelerators in Kubernetes for applications with intensive data processing related to improper authorization. Exploiting this vulnerability can allow attackers to gain full privileged access to the entire cluster...

Security Bulletin: Multiple publicly disclosed libcurl vulnerabilities affect IBM Safer Payments

Summary Libcurl is used by IBM Safer Payments as part of the AVRO support for Kafka. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-38039 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by not limiting the number and size of headers accept i...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.8.6 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.8.6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2024-20283

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries t...

CVE-2024-20283

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries t...

CVE-2024-20283

Cisco Nexus Dashboard contains an information-disclosure vulnerability (CVE-2024-20283) due to improper access controls on a specific API endpoint. An authenticated remote attacker could query the API to access metrics and deployment information for devices within the Nexus Dashboard cluster. The...

Cisco Nexus Dashboard Information Disclosure Vulnerability

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries t...

CVE-2024-1139

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.54 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.54 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

PT-2024-3859 · Cisco · Cisco Nexus Dashboard

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard affected versions not specified Description: The issue is related to insufficient access controls on a specific API endpoint, allowing a remote attacker to gain unauthorized access to protected information by sending...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.6 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

BIT-DISCOURSE-2024-27100 Denial of service via Staff Actions in Discourse

Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could...

Improper Authorization

org.elasticsearch:elasticsearch is vulnerable to Improper Authorization. The vulnerability is due to the improper validation of API key permissions, allowing a malicious user with a valid API key for a remote cluster configured with new Remote Cluster Security to read arbitrary documents from any...

Important: Red Hat Security Advisory: ACS 4.4 enhancement and security update

Important: Updated images are now available for Red Hat Advanced Cluster Security. Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. This release includes the following features and updates: New Compliance capabilities...