Authentication Bypass

github.com/kubernetes/dashboard is vulnerable to authentication bypass. The vulnerability allows unauthorized users to bypass authentication and gain access to the dashboard's exclusive as the Dashboard's Service Account to retrieve confidential information...

Kubernetes Dashboard < 1.10.1 Authentication Bypass Vulnerability

Kubernetes Dashboard is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-18264: Kubernetes Dashboard TLS Certificate Leak | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Cloud Foundry Container Runtime CFCR All versions prior to 0.26.0 Description Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard’s Service Account for reading...

grafana: XSS vulnerability via the "Dashboard > Text Panel" screen

A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS in the "Dashboard Text Panel" screen...

Moderate: Red Hat Security Advisory: grafana security and bug fix update

The updated grafana package is now available for Red Hat Ceph Storage 3.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

Authentication flaw

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster...

CVE-2018-18264

CVE-2018-18264 : Kubernetes Dashboard versions prior to 1.10.1 are vulnerable to an authentication bypass that allows an attacker to use the Dashboard’s Service Account to read secrets in the cluster. This weakness is documented in multiple sources (NVD, Nuclei template, OSSV, etc.). Affected pro...

Kubernetes Dashboard Authentication Bypass Vulnerability

Google Kubernetes is an open source Docker container cluster management system from Google, Inc. The system provides resource scheduling , deployment and operation , service discovery and scaling up and down for containerized applications.Kubernetes Dashboard is a Web-based common interface for...

Cross site request forgery (csrf)

UWA 2.3.11 allows index.php?g=admin&c=admin&a=addadmindo CSRF...

Code injection

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

UBUNTU-CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

Jackhammer - One Security Vulnerability Assessment/Management Tool To Solve All The Security Team Problems

One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and track the qualit...

Zomato: [www.zomato.com] Blind XSS in one of the admin dashboard

Summary: Admin dasboard ████ from user has XSS Vul Steps To Reproduce: 1. Login ██████ 1. Go to ███ function and intercept request Post data: "/zomato.php?c=zomatoxss" / POST ████ HTTP/1.1 X-Zomato-App-Version-Code: 5610001 ██████████ ███████ X-Zomato-API-Key: ███████ X-App-Language:...

dashboard.heineken.com XSS vulnerability

Open Bug Bounty ID: OBB-710197 Description| Value ---|--- Affected Website:| dashboard.heineken.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Global IT Asset Inventory: The Foundation for Security and Compliance

Pablo Quiroga, Qualys’ Director of Product Management for IT Asset Management, talks about the new Asset Inventory solution When IT directors and CISOs look at their digitally transformed networks, they encounter many shadows that their legacy enterprise software tools can’t illuminate. These bli...

Persistent XSRF on Kubernetes Dashboard using Redhat Keycloak Gatekeeper on Microsof Azure

tl;dr I found an XSRF in the OAuth implementation of Redhat Keycloak Gatekeeper. This would be a bit worse for people using Gatekeeper to protect their Kubernetes Dashboard especially in Microsof Azure. The Issue in Keycloak Gatekeeper Keycloak Gatekeeper is an OpenID Proxy service for Keycloak, ...