CVE-2021-25735

A vulnerability was found in Kubernetes' kube-apiserver that could allow Node updates to bypass a Validating Admission Webhook. An authenticated user could exploit this by modifying Node properties to values that should have been prevented by registered admission webhooks...

CVE-2021-25735

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the No...

Zulip 访问控制错误漏洞

Zulip server is an open source team chat application from the American company Zulip. An access control error vulnerability exists in versions of Zulip Server prior to 3.4, which stems from a bug in the implementation of replies to messages that send a webhook to a private stream.No details of th...

Kubernetes SIGs kube-apiserver 安全漏洞

Kubernetes SIGs kube-apiserver is a Kubernetes SIGs open source application. Validate and configure data for api objects, which include containers, services, replication controllers, and more. A security vulnerability exists in Kubernetes SIGs kube-apiserver that allows node updates to bypass a...

Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node...

PT-2021-6462 · Unknown +2 · Kube-Apiserver +2

Name of the Vulnerable Software and Affected Versions: kube-apiserver affected versions not specified Description: A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run...

CertEagle - Asset monitoring utility using real time CT log feeds

In Bugbounties “If you are not first , then you are last ” there is no such thing as silver or a bronze medal , Recon plays a very crucial part and if you can detect/Identify a newly added asset earlier than others then the chances of you Finding/Reporting a security flaw on that asset and gettin...

CVE-2020-4719

The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861...

Authorization

The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861...

CVE-2020-4719

The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861...

Kubernetes: API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint

Report Submission Form Summary: I was trying to explore a way to stealthily send lots of data outside a private GKE cluster by way of misusing the Validating Webhook mechanism. The idea would be that a cluster-admin could install a webhook and then initiate resources like a secret or configmap th...

Kubernetes: Node Validation Admission does not observe all oldObject fields

Summary: The Validating Admission webhook for Node Objects is passing oldObject fields incorrectly on AdmissionReview.Request. It was identified initially in metadata.labels, but a list of impacted fields follows below: oldNode.Spec.PodCIDRs oldNode.Spec.ProviderID oldNode.Spec.ConfigSource...

PT-2021-4075

Name of the Vulnerable Software and Affected Versions GitLab versions 10.5 and later Description The issue is a server-side request forgery SSRF in GitLab. When requests to the internal network for webhooks are enabled, an unauthenticated attacker can exploit this issue, even on a GitLab instance...

CVE-2020-35236

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion...

CVE-2020-35236

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion...

Arbitrary file deletion

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion...

CVE-2020-35236

The CVE-2020-35236 entry concerns the GitLab Webhook Handler in amazee.io Lagoon prior to version 1.12.3, which has incorrect access control related to project deletion. The vulnerability stems from insufficient authorization checks in the webhook handler, potentially allowing unauthorized projec...

CVE-2020-35236

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion...

Amazee Lagoon Access Control Error Vulnerability

Amazee Lagoon is a rapid delivery platform for OpenShift and Kubernetes from Amazee. A security vulnerability exists in Amazee Lagoon versions prior to 1.12.3 that stems from incorrect access control and project deletion in the GitLab Webhook Handler...

Malicious Package

Overview The package discord.dll contained malicious code. The package ran a postinstall script that exfiltrated local files such as browser local databases. The information was exfiltrated to a remote Discord webhook. Recommendation Remove the package from your system and rotate any credentials...