233 matches found
kubernetes-goat
Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster...
Owasp-top-10-k8s-2025
OWASP Kubernetes Top 10 2025, hands-on A capture-the-flag built on the OWASP Kubernetes Top 10 — 2025. You've been hired to red-team NimbusMart , a fictional e-commerce company whose cluster grew faster than its security. Ten challenges, one per OWASP risk plus a bonus — exploit each weakness,...
CVE-2023-5044
CVE-2023-5044 Poc for CVE 2023 5044 Prerequisites Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 PoC Give Docker the correct privileges sudo usermod -aG docker $USER && newgrp docker Start the cluster with extraPortMaping and node-labels to prepare it for an ingress. cat EOF | kind create cluster...
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...
CVE-2026-108729
Versions of Corteza up to 2024.9.10 are vulnerable to an incorrect authorization flaw in the compose attachment endpoints . This vulnerability allows unauthenticated attackers to download private attachments by manipulating the URL kind segment to values such as page, icon, or namespace. If an at...
PT-2026-110132
Name of the Vulnerable Software and Affected Versions Corteza versions prior to 2024.9.11 Description An incorrect authorization issue exists in the compose attachment endpoints. Unauthenticated attackers can download private attachments by modifying the URL kind segment to page, icon, or...
GO-2026-6607 vulnerabilities
Vulnerabilities for packages: aws-flb-cloudwatch, go-fips, whereabouts-fips, google-guest-agent-manager, tflint-fips, azure-metrics-exporter, falcosidekick-fips, glow, crossplane-provider-aws-sesv2-fips, grafana-pyroscope, crossplane-function-patch-and-transform-fips,...
GHSA-F5VF-8PVC-394G vulnerabilities
Vulnerabilities for packages: aws-flb-cloudwatch, go-fips, whereabouts-fips, google-guest-agent-manager, tflint-fips, azure-metrics-exporter, falcosidekick-fips, glow, crossplane-provider-aws-sesv2-fips, grafana-pyroscope, crossplane-function-patch-and-transform-fips,...
CVE-2026-56866 vulnerabilities
Vulnerabilities for packages: aws-flb-cloudwatch, go-fips, whereabouts-fips, google-guest-agent-manager, tflint-fips, azure-metrics-exporter, falcosidekick-fips, glow, crossplane-provider-aws-sesv2-fips, grafana-pyroscope, crossplane-function-patch-and-transform-fips,...
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
GHSA-W2CH-4XGR-22WW Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
PT-2026-98151
Name of the Vulnerable Software and Affected Versions libical version 4.0.6 Description An incompatible function pointer exists in the icalparameter string to kind function. When parsing iCalendar data that includes a parameterized property, the function passes icalparameter compare kind map to...
GO-2023-1839 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-2043 vulnerabilities
Vulnerabilities for packages: kind, metrics-server, kubeflow-katib...
GO-2023-1840 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-2041 vulnerabilities
Vulnerabilities for packages: kind, metrics-server, kubeflow-katib...
GO-2023-1841 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-1842 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...