The vulnerability of the CSI Proxy component of the Kubernetes cluster management software allows a hacker to increase their privileges.

The vulnerability of the CSI Proxy component, a software tool for managing virtual machine clusters in Kubernetes, is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2023-40585

ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listenin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service due to [CVE-2023-26115]

Summary Node.js word-wrap is used internally by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Node.js word-wrap...

ROS-20230824-01

The Swarm Mode vulnerability of the dockerd daemon of the containerization software tool Moby and the Mirantis Container Runtime runtime is related to the use of the Swarm Mode of the dockerd daemon. Moby container isolation system and Mirantis Container Runtime is related to the use of an insecu...

Metal3 Ironic Container 访问控制错误漏洞

The Metal3 Ironic Container is the file required to build Ironic images used by Metal3. An access control error vulnerability exists in Metal3 Ironic Container versions prior to capm3-v1.4.3, which stems from a vulnerability that allows an unauthenticated attacker to access Ironic APIs that are n...

Spring-Kafka has Java Deserialization vulnerability When Improperly Configured

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...

Security Bulletin: IBM App Connect Enterprise Certified Container operands that use the Box or Snowflake connectors are vulnerable to arbitrary code execution due to [CVE-2023-37466], [CVE-2023-37903]

Summary Node.js module vm2 is used internally by the Box and Snowflake connectors in Designer flows in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands that run Designer flows...

OSV-2023-734 Container-overflow in libbrotlidec.so.1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61675 Crash type: Container-overflow WRITE Crash state: libbrotlidec.so.1 BrotliDecoderDecompressStream Exiv2::BmffImage::brotliUncompress...

Why Your AWS Cloud Container Needs Client-Side Security

With increasingly complicated network infrastructure and organizations needing to deploy applications across various environments, cloud containers are necessary for companies to stay agile and innovative. Containers are packages of software that hold all of the necessary components for an app to...

CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...

PT-2023-35969 · Unknown +1 · Libbrotlidec +1

Name of the Vulnerable Software and Affected Versions: Exiv2 affected versions not specified Description: The issue is related to a crash caused by a container-overflow write in the BrotliDecoderDecompressStream function, which is called by Exiv2::BmffImage::brotliUncompress. This crash occurs in...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.30 packages and security update

Red Hat OpenShift Container Platform release 4.12.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.30 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: AMQ Broker 7.11.1.OPR.2.GA Container Images Release

This is the multiarch release of the AMQ Broker 7.11.1 aligned Operator and associated container images on Red Hat Enterprise Linux 8 for the OpenShift Container Platform. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System...

RHEL 7 : subscription-manager (RHSA-2023:4701)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4701 advisory. The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat...

PT-2023-35959 · Apache · Apache Poi

Name of the Vulnerable Software and Affected Versions: Apache POI affected versions not specified Description: The issue is related to a security exception in the EscherContainerRecord.fillFields function. The crash state involves the org.apache.poi.ddf.EscherContainerRecord.fillFields,...

PowerJob incorrect access control vulnerability

An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list...

CVE-2023-36106

An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list...

CVE-2023-36106

An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list...

PT-2023-25430 · Powerjob · Powerjob

Name of the Vulnerable Software and Affected Versions: powerjob versions 4.3.2 and earlier Description: An incorrect access control issue allows remote attackers to obtain sensitive information via the interface for querying using the appId parameter to the "/container/list" endpoint...