Omnissa UAG 安全漏洞

Omnissa UAG Omnissa Unified Access Gateway is a unified access gateway from Omnissa Corporation. A security vulnerability exists in the Omnissa UAG that stems from a cross-resource sharing bypass that could result in bypassing administrator-configured CORS restrictions to access sensitive network...

HCL Compass 跨站请求伪造漏洞

HCL Technologies Compass is a low-code change management software from HCL Technologies, USA. It manages the full range of testing activities and integration with developer tools. A security vulnerability exists in HCL Compass that stems from the presence of a Cross Resource Sharing CORS...

AZL-13782 CVE-2022-3162 affecting package kube-vip-cloud-provider for versions less than 0.0.2-21

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-25938 CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

Last Yard 安全漏洞

Last Yard is a shelf-edge promotional platform from Last Yard Australia. A security vulnerability exists in Last Yard version 22.09.8-1, which stems from the fact that it allows an attacker to enable cross-resource sharing...

Unauthorized read of Custom Resources

CVSS Rating: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Am I...

IBM Spectrum Protect Plus访问控制错误漏洞

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes.A security vulnerability exists in IBM Spectrum Protect...

envoy: Incorrect Access Control when using SDS with Combined Validation Context

An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions...