Endpoint & EndpointSlice permissions allow cross-Namespace forwarding

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack. This issue has been rated Low severity CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, and assigned CVE-2021-25740. Am I...

Gorsair - Hacks Its Way Into Remote Docker Containers That Expose Their APIs

Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendous risk,...

Huawei Data Communication: Memory Leak Vulnerability in Huawei Products (huawei-sa-20210506-01-memleak)

There is a memory leak vulnerability in Huawei products. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

CVE-2021-22341

There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module...

Memory corruption

There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module...

CVE-2021-22341

There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module...

CVE-2021-22341: Missing Release of Memory after Effective Lifetime

There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module...

Huawei Data Communication: Information Leak Vulnerability in Huawei Products (huawei-sa-20210428-01-infomationleak)

There is an information leak vulnerability in Huawei products. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-22342

There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions...

Information disclosure

There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions...

CVE-2021-22342

CVE-2021-22342 affects Huawei IPS/NGFW/USG family devices (IPS Module V500R005C00/ C10/ C20; NGFW V500R005C00/C10/C20; SeMG9811 V500R005C00; USG9500 V500R001C00/20/30/50/60/80 and V500R005C00/10/20). Root cause: a module does not sufficiently validate input, allowing information disclosure by hig...

CVE-2021-22342

There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions...

CVE-2021-22342: Undefined Security Weakness

There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability (CVE-2020-8554)

Summary IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster CVE-2020-8554 Vulnerability Details CVEID: CVE-2020-8554 Description: Kubernetes could allow a remote authenticate...

The vulnerability of the IPS\cms\modules\front\pages\_builder::previewBlock method in the IPS Community Suite web forum software allows a hacker to execute arbitrary PHP code.

The vulnerability of the IPS\cms\modules\front\pages\builder::previewBlock method in the IPS Community Suite web forum software is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary PHP code remotely...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

Code injection

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

CVE-2021-32924

Invision Community (IPS Community Suite) before 4.6.0 is vulnerable to an eval-based PHP code injection via the moderator-accessible previewBlock path in IPS\cms\modules\front\pages_builder::previewBlock, which interacts unsafely with IPS_Theme::runProcessFunction. Root cause: unsafe handling ena...

CVE-2021-32924: Improper Control of Generation of Code

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

IPS Community Suite 4.5.4.2 PHP Code Injection Vulnerability

IPS Community Suite versions 4.5.4.2 and below suffer from a PHP code injection vulnerability. The vulnerability exists because the IPS\cms\modules\front\pages\builder::previewBlock method allows to pass arbitrary content to the IPS\Theme::runProcessFunction method, which will be used in a call t...