infosec-notebook

infosec-notebook Personal cybersecurity notes and references...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

Attacker Lab: CVE-2017-5638 & CVE-2021-41773 A 7-host Docker-...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: coredns, kube-logging-operator-custom-runner, trivy-operator, argo-workflows, pdfcpu, omnibump, cri-tools, nats, clickhouse-operator, http-echo, secrets-store-csi-driver-provider-azure, metrics-agent, go-licenses, gh, kubernetes-dashboard-metrics-scraper, flannel,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: coredns, rancher-agent, trivy-operator, kubernetes-dashboard-auth, argo-workflows, kyverno-notation-aws, kyverno, flux-helm-controller, grpcurl, terraform-provider-kubernetes, gatus, cri-tools, kyverno-policy-reporter-ui, rancher,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: coredns, rancher-agent, trivy-operator, kubernetes-dashboard-auth, argo-workflows, kyverno-notation-aws, kyverno, flux-helm-controller, grpcurl, terraform-provider-kubernetes, gatus, cri-tools, kyverno-policy-reporter-ui, rancher,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: extism, cephcsi-fips, knative-serving-fips, aws-load-balancer-controller-fips, prometheus-podman-exporter, gitlab-kas, aws-flb-kinesis, chartmuseum, nats-fips, nats, vault-fips, tkn-fips, vault, tekton-pipelines, weaviate, k3s, splunk-otel-collector-fips,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, cephcsi-fips, crossplane-provider-aws-rolesanywhere-fips, prometheus-snmp-exporter, smarter-device-manager-fips, knative-serving-fips, aws-load-balancer-controller-fips, cert-manager-csi-driver, prometheus-podman-exporter, gitlab-kas,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, cephcsi-fips, crossplane-provider-aws-rolesanywhere-fips, prometheus-snmp-exporter, smarter-device-manager-fips, knative-serving-fips, aws-load-balancer-controller-fips, cert-manager-csi-driver, prometheus-podman-exporter, gitlab-kas,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: extism, cephcsi-fips, knative-serving-fips, aws-load-balancer-controller-fips, prometheus-podman-exporter, gitlab-kas, aws-flb-kinesis, chartmuseum, nats-fips, nats, vault-fips, tkn-fips, vault, tekton-pipelines, weaviate, k3s, splunk-otel-collector-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: extism, terraform-provider-pagerduty, s5cmd-fips, cephcsi-fips, crossplane-provider-aws-rolesanywhere-fips, prometheus-snmp-exporter, knative-serving-fips, wuzz, cilium-certgen, aws-load-balancer-controller-fips, aws-privateca-issuer-fips, cert-manager-csi-driver,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: extism, terraform-provider-pagerduty, s5cmd-fips, cephcsi-fips, crossplane-provider-aws-rolesanywhere-fips, prometheus-snmp-exporter, smarter-device-manager-fips, knative-serving-fips, wuzz, cilium-certgen, aws-load-balancer-controller-fips, aws-privateca-issuer-fips...

CVE-2026-27140 vulnerabilities

Vulnerabilities for packages: extism, cephcsi-fips, knative-serving-fips, linkerd2-fips, aws-privateca-issuer-fips, dynamic-localpv-provisioner, wait-for-port, influx, sftpgo-plugin-geoipfilter, aws-iam-authenticator, vault-fips, vault, mig-parted-fips, descheduler, spark-operator,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: extism, cephcsi-fips, knative-serving-fips, linkerd2-fips, aws-privateca-issuer-fips, dynamic-localpv-provisioner, wait-for-port, influx, sftpgo-plugin-geoipfilter, aws-iam-authenticator, vault-fips, vault, mig-parted-fips, descheduler, spark-operator,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: extism, terraform-provider-pagerduty, s5cmd-fips, cephcsi-fips, crossplane-provider-aws-rolesanywhere-fips, prometheus-snmp-exporter, knative-serving-fips, wuzz, cilium-certgen, aws-load-balancer-controller-fips, aws-privateca-issuer-fips, cert-manager-csi-driver,...

gramps-webapi: Zip Slip Path Traversal in Media Archive Import

Summary A path traversal vulnerability Zip Slip exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the...

GHSA-7XGM-5PRM-V5GC vulnerabilities

Vulnerabilities for packages: virt-handler, docker-machine-driver-harvester, virt-controller-fips, virt-operator-fips, virt-launcher...

GHSA-9M94-W2VQ-HCF9 vulnerabilities

Vulnerabilities for packages: virt-handler, docker-machine-driver-harvester, virt-controller-fips, virt-operator-fips, virt-launcher...

CVE-2025-64436 vulnerabilities

Vulnerabilities for packages: virt-handler, docker-machine-driver-harvester, virt-controller-fips, virt-operator-fips, virt-launcher...

S3CDM: A Secret-Sharing-Scheme-Based Cyberattack Detection Model and Its Simulation Implementation

We design and develop a secret-sharing-scheme-based cyberattack detection modelS3CDMthat can detect unauthorized or illegal activities especially insider attacks and protect sensitive information within complex network infrastructures of large organizations. The model splits a secret among a grou...

Arcane code issues and vulnerabilities

Arcane is an open-source Docker management software developed by Arcane. Versions of Arcane prior to 1.17.3 contained code vulnerabilities. These vulnerabilities stemmed from the /api/templates/fetch endpoint, which accepted URL parameters provided by callers and processed HTTP GET requests witho...