kcp's impersonation allows access to global administrative groups

Impact Impersonation is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the linked documentation a specific level of privilege usually assigned to cluster admins is required for impersonation. The vulnerability in kc...

CVE-2024-48912

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue...

CVE-2024-47760

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

CVE-2024-48912 GLPI vulnerable to authenticated insecure account deletion

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue...

CVE-2024-48912 GLPI vulnerable to authenticated insecure account deletion

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue...

CVE-2024-47761 GLPI vulnerable to account takeover via the password reset feature

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

CVE-2024-47760 GLPI vulnerable to account takeover via API

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

CVE-2024-47758

CVE-2024-47758 affects GLPI: authenticated users can via the API take control of another user with equal or lower privileges in versions 9.3.0 up to, but not including, 10.0.17. A patch is available in 10.0.17. Connected documents corroborate GLPI context and indicate multiple vendor advisories f...

CVE-2024-53677

A flaw in the file upload logic of Apache Struts (versions 2.0.0 to before 6.4.0) allows an unauthenticated attacker to manipulate file upload parameters to enable path traversal . This can result in the upload of a malicious file, potentially leading to Remote Code Execution (RCE) . The vulnerab...

CVE-2024-50167 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50167 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50230 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50230 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50007 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50007 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-47690 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-47690 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-47723 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-47723 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-47742 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-47742 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-47720 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-47720 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-49967 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-49967 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

PT-2024-36379 · Apple · Macos Sonoma +7

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 macOS Ventura versions prior to 13.7.2 macOS Sonoma versions prior to 14.7.2 Description:...

php:8.2 security update

libzip php 8.2.25-1 - rebase to 8.2.25 RHEL-66166 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

CVE-2024-55602

PwnDoc vulnerability CVE-2024-55602 allows an authenticated user who can update and download templates to perform path traversal ("../") in the file extension field, enabling arbitrary file reads on the host. The issue is triggered prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, which i...