CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

CVE-2024-45041

CVE-2024-45041 affects the External Secrets Operator. A deployment named default-external-secrets-cert-controller is bound to a ClusterRole that grants Harper access: it can perform get/list on secrets resources and patch/update on validatingwebhookconfigurations. This RBAC configuration can be a...

CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

Moderate: Red Hat Security Advisory: Cost Management enhancement and security update

Downstream release of version 3.3.1 of the Cost Management operator. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

PT-2024-38017 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: A broken access control issue has been discovered, allowing less-privileged operator- and/or viewer accounts to have more privileges than designed. The risk of exploitation is very low, as ...

CVE-2024-40681

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager...

CVE-2024-40680

IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault...

CVE-2024-40681

CVE-2024-40681 affects IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. An authenticated user in a specifically defined role could bypass security restrictions and execute actions against the queue manager. The issue is a security bypass in IBM MQ/Operator context; remediation requi...

CVE-2024-40681 IBM MQ security bypass

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager...

CVE-2024-40681 IBM MQ security bypass

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager...

CVE-2024-40680 IBM MQ denial of service

IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault...

CVE-2024-40680 IBM MQ denial of service

IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault...

CVE-2024-40680

CVE-2024-40680 affects IBM MQ 9.3 CD and 9.4 LTS/CD. The vulnerability allows a local user to cause a denial of service via improper memory allocation leading to a segmentation fault. The IBM advisories state remediation via APAR IT45634: for IBM MQ 9.3 CD, upgrade to 9.4 and apply Fix Pack 9.4.0...

PT-2024-28982 · Ibm · Ibm Mq +1

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.3 CD and 9.4 LTS/CD IBM MQ Operator versions 2.0.26 and 3.2.4 Description: The issue is related to improper memory allocation, which can cause a segmentation fault, allowing a local user to cause a denial of service...

IBM MQ 安全漏洞

IBM MQ Operator is a tool from International Business Machines IBM for managing the lifecycle of IBM MQ Queue Manager. A security bypass vulnerability exists in IBM MQ Operator versions 2.0.26 and 3.2.4, which can be exploited by an authenticated attacker in a specifically defined role to...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to denial of service, privilege escalation and kerberos 5

Summary Kerberos 5 and IBM MQ used by IBM MQ Operator and Queue Manager container images are vulnerable to denial of service due to improper memory allocation, and privilege escalation which may lead to bypassing security restrictions. This bulletin identifies the steps required to address these...

Division By Zero Error

TensorFlow is vulnerable to Division By Zero Error. The vulnerability is due to improper validation of the params input in the GatherNd TFLite operator, which allows an empty tensor to craft a malicious model that can trigger a division by zero and causing a zero dimension in paramsshape.Dims...

Secret Exfiltration

github.com/metal3-io/baremetal-operator is vulnerable to Secret Exfiltration. The vulnerability is due to BMO's ability to read Secrets from any namespace, which allows an attacker to exfiltrate Secrets from other namespaces by linking them to a BareMetalHost configuration...

Division By Zero Error

TensorFlow is vulnerable to a Division By Zero Error. The vulnerability is due to the EmbeddingLookup TFLite operator not checking if the first dimension of the value input is zero before performing a division operation. It allows an attacker to craft a model that triggers the error, potentially...