Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to improper validation of user-supplied pod specifications in the Environment process. An attacker can gain elevated privileges and potentially escape the node by specifying dangerous fields such as...

Insertion of Sensitive Information into Externally-Accessible File or Directory

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory in the KubernetesExecutor process. An attacker can gain unauthorized access to sensitive API endpoints by harvesting JWT tokens from command-line arguments...

CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of...

CVE-2024-38367

CVE-2024-38367 concerns the CocoaPods trunk authentication server (trunk.cocoapods.org). The underlaying issue was a vulnerability in the trunk sessions verification step that could be manipulated to hijack the owner’s session, potentially yielding a full takeover of the CocoaPods trunk account. ...