Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation during SSH connections if the certificate isn’t set in the knownhosts file. An attacker can intercept and manipulate data by positioning themselves between the client and server, effectively conducting a...

PT-2025-19348 · Fleet · Fleet

Name of the Vulnerable Software and Affected Versions: Fleet versions prior to v0.10.12 Fleet versions prior to v0.11.7 Fleet versions prior to v0.12.2 Description: A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate whe...

CVE-2025-30702

Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fleet Patching and amp; Provisioning...

CVE-2025-30702

Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fleet Patching and amp; Provisioning...

CVE-2025-30702

Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fleet Patching and amp; Provisioning...

Oracle Database Server 安全漏洞

Oracle Database Server is a relational database management system from Oracle Corporation USA. This database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Fleet Patching and Provisioning versions 19.3 through 19.26 of...

PT-2025-16436 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.26 Description: The issue affects the Fleet Patching and Provisioning component of Oracle Database Server, allowing an unauthenticated attacker with network access via HTTP to compromise it...

CVE-2024-40635 vulnerabilities

Vulnerabilities for packages: zot, opa-envoy, docker-compose, flux-source-controller, nerdctl, kargo, grype, newrelic-infrastructure-agent, opa, eksctl, k8ssandra-client, spegel, fuse-overlayfs-snapshotter, docker-cli-buildx, kubescape, linkerd2, k3s, flux-helm-controller, skaffold, ctop,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: zot, opa-envoy, docker-compose, flux-source-controller, nerdctl, kargo, grype, newrelic-infrastructure-agent, opa, eksctl, k8ssandra-client, spegel, fuse-overlayfs-snapshotter, docker-cli-buildx, kubescape, linkerd2, k3s, flux-helm-controller, skaffold, ctop,...

SUSE CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet

Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

CVE-2025-27509 SAML authentication vulnerability due to improper SAML response validation

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

CVE-2025-27509

Fleet has a SAML authentication vulnerability (CVE-2025-27509) due to improper SAML response validation in fleetdm/fleet. In vulnerable versions, an attacker could forge authentication assertions, potentially provisioning a new administrative user under JIT provisioning or creating accounts tied ...

Fleet 授权问题漏洞

Fleet is an open source device management platform from Fleet that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM, and more, free and flexible. An authorization issue vulnerability exists in Fleet versions...

GHSA-JGFP-53C3-624W vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, calico-fips, node-feature-discovery, rancher-agent, azuredisk-csi-fips, argo-rollouts, yunikorn-k8shim, nodetaint, kubernetes-csi-driver-nfs, aws-efs-csi-driver, ip-masq-agent, spark-operator-fips, kapp, vcluster,...

CVE-2025-0426 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, local-static-provisioner, vcluster, argocd-image-updater, spark-operator, kubernetes-csi-driver-nfs, emissary, rancher-fleet, kapp, rancher-webhook, argo-rollouts, ip-masq-agent, kubernetes,...

CVE-2025-0426 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, calico-fips, node-feature-discovery, rancher-agent, azuredisk-csi-fips, argo-rollouts, yunikorn-k8shim, nodetaint, kubernetes-csi-driver-nfs, aws-efs-csi-driver, ip-masq-agent, spark-operator-fips, kapp, vcluster,...

CVE-2020-26276

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet...