254 matches found
harbor
Team Introduction Chongqing Jiugongge Security Team is committed to sharing open-source security tools, with research directions covering red-blue confrontation, Web security, mobile security, security development, enterprise security construction, IoT/Industrial Control Security/AI/Quantum...
kubebot
Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...
CVE-2024-23653
root@kitploit: syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status root@kitploit: sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. root@kitploit: ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. ...
automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
CVE-2026-84703
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...
CVE-2022-46463
CVE-2022-46463 CVE-2022-46463POC Harbor Unauthorized For vulnerability details, see Stack Community Use root@kitploit: python3 cvve-2022-46463.py -u https://127.0.0.1:5003 Options root@kitploit: -u URL, --url URL Target URL e.g. http://example.com -h, --help Show help message and exit Directly...
CVE-2019-16097
CVE-2019-16097 Harbor Unauthorized Admin Creation Vulnerability Principle docker and poc based on pocsuite framework...
EUVD-2026-82584
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69865
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69865
Microsoft Container Registry is affected by an authorization bypass through user-controlled key , allowing an unauthorized attacker to elevate privileges over a network . The CVSS v3.1 base score is 10.0 (Critical) with a changed scope and high impact to both confidentiality and integrity, while ...
Microsoft Container Registry Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69865: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-65388
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...
CVE-2026-65388
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...
EUVD-2026-81274
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...
CVE-2026-65388
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...
CVE-2026-65388
Apple's containerization library (apple/container) is vulnerable to a credential disclosure attack. A remote attacker who controls a container registry can redirect a client's token request to an attacker-chosen host, leaking the victim's registry credentials . Rapid7 classifies the issue as URL ...
CVE-2026-88887
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...