Portworx Half-Blind SSRF in kube-controller-manager

...

PT-2025-51678

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.2-ga1582f1a031e Description The Linux kernel had a flaw related to the admin request queue lifetime in the NVMe subsystem. Namespaces could access the controller's admin request queue, and stale references...

PT-2025-51691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to a race condition within the dwc3 remove requests function. This occurs due to unsynchronized execution of multiple call paths, potentially...

PT-2025-51708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Bluetooth implementation within the Linux kernel, specifically in the hci core component. The issue relates to improper locking mechanisms when handling Bluetooth...

CVE-2025-14722

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722

CVE-2025-14722 affects vion707 DMadmin (Backend) with a Cross-Site Scripting vulnerability in the Add function of Admin/Controller/AddonsController.class.php. A remote attacker can manipulate input to trigger XSS; exploits have been publicly disclosed. Affected versions are prior to 3403cafdb4253...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-13281

A half-blind Server-Side Request Forgery SSRF found in kube-controller-manager that can be triggered when using the legacy in-tree Portworx StorageClass. An authorized user with sufficient privileges can cause the controller to make requests to internal, host-network–accessible endpoints,...

CVE-2025-13824

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and...

kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

EUVD-2025-203310

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

GHSA-R6J8-C6R2-37RR kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

Rockwell Automation多款产品 安全漏洞

The Rockwell Automation Micro820, among others, is a programmable controller from Rockwell Automation USA. A security vulnerability in several Rockwell Automation products, which stems from improper handling of malformed packets by the IPv6 stack, could cause the controller to enter a recoverable...

PT-2025-51312

Name of the Vulnerable Software and Affected Versions vion707 DMadmin versions prior to 3403cafdb42537a648c30bf8cbc8148ec60437d1 Description A cross-site scripting issue exists in vion707 DMadmin. The issue is located in the Add function of the Admin/Controller/AddonsController.class.php file...

DMadmin 代码注入漏洞

DMadmin is China vion707 open source a basic interface framework . DMadmin code injection vulnerability exists , the vulnerability stems from the file Admin/Controller/AddonsController.class.php in the Add function there is a cross-site scripting vulnerability can be exploited remotely...

AZL-72382 CVE-2025-13281 affecting package kubernetes for versions less than 1.30.10-18

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

CVE-2025-13281

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

DEBIAN-CVE-2025-13281

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

AZL-72386 CVE-2025-13281 affecting package kubernetes for versions less than 1.28.4-21

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...